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1.  SUMMARY 


■  This  report  describes  a  technology  program  for  a  candidate 
Fly-By-Wire  (FEW)  Control  System  with  an  auxiliary  (back-up) 
mechanical  control  system  for  use  in  a  potential  test  helicop¬ 
ter.  In  addition  to  covering  the  basic  program,  it  includes 
an  updated  discussion  on  the  4-Valve  Actuation  Control  Concept 
(V4-ACC)^  and  a  copy  of  the  Integration  Test  Plan  in  the  Appen¬ 
dices.  ^ 

1.1  SCOPE 

The  program  included  the  design,  fabrication,  test,  and  eval¬ 
uation  of  a  laboratory  model  of  the  candidate  actuation  sys¬ 
tem.  The  system  basically  consists  of  the  V4-ACC  module  with 
a  mechanical  back-up  control  that  can  be  used  as  a  permanent 
function  or  to  enhance  safety  during  the  initial  phase  of  an 
anticipated  development  flight  test  program.  The  current 
program  entailed  developing  electronic  circuitry  that  subse¬ 
quently  can  be  used  in  a  flight  test  model;  modifying  the 
existing  V4-ACC  module  so  that  it  would  accept  a  mechamical 
control  input  as  well  as  a  quad  electrical  input;  and  conduct¬ 
ing  operational  suitability  and  failure  mode  effect  tests  on 
the  system  depicted  in  block  diagram  form  in  Figure  1.  The 
major  equipments  are  shown  in  Figures  2,  3,  and  4. 

The  concept  of  this  control  system  can  be  applied  to  almost 
any  helicopter,  tilt  rotor,  or  fixed  wing  control  system. 

1.2  OBJECTIVE 

^The  objective  of  this  progreim  was  to  evaluate  the  V4-ACC 
mechanical  system  relative  to  its  potential  use  in  a  potential 
test  helicopter.  The  evaluation  primarily  related  to  opera¬ 
tional  characteristics,  failure  mode  effects,  and  the  automa¬ 
tic/manual  reversion  to  the  mechanical  back-up  control  system. 
The  objective  was  accomplished  by  developing  a  laboratory  test 
model,  of  the  FCS,  installing  the  model  on  a  suitable  test 
stand,  and  conducting  leiboratory  tests  in  accordance  with  the 
Integration  Test  Plan  (see  Appendix  B). 

1.3  CONCLUSIONS 

S  laboratory  model  of  the  V4-ACC  has  been  evaluated  within  the 
scope  of  this  progreun  and  is  recommended  as  a  valid  candidate 
for  use  in  a  potential  test  helicopter,^  Implementation  of  the 
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TEST  PILOT  FEW 
CONTROL  STICK 
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Figure  1.  Simplified  Block  Diagram  of  FB\;  Control 
System  liith  Mechanical  Reversion. 


V4 -ACC/MECKANICAL 
SYSTEM 


Figure  3.  Electronic  Control  Unit. 
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Figure  4. 


Hydraulic  Actuator  With  a  V4-ACC  Module/ 
Mechanical  Head. 


mechanical  reversion  (back-up)  feature  was  easily  accomplished 
and  could  be  used  as  a  permanent  part  of  the  control  concept; 
however,  because  of  the  predicted  low  failure  rate  and  posi¬ 
tive  redundancy  management  characteristics  offered  by  the 
V4-ACC,  It  is  recommended  that  the  mechanical  back-up  mode  be 
used  during  the  development  phase  of  any  future  application 
and  then  removed  after  the  integrity  of  the  V4-ACC  has  been 
established. 

The  above  recommendations  are  based  on  the  pertinent  attri¬ 
butes  listed  below. 

Simplicity  -  functionally,  as  well  as  low  parts  count, 
relates  to  low  failure  rates,  low  cost,  and  low  weight. 

•  Failure  Tolerance  -  basic  system  is  single  fail-operate ; 
addition  of  a  simple  failure  management  system  provides 
dual  fail-operate  for  control  paths. 

•  Unique  Multiple-Path  Tracking  Feature  -  makes  the  system 
less  sensitive  to  tolerance  build-up  in  control  path  ele¬ 
ments;  provides  a  well  defined  actuator  output  impedance 
about  null. 

Efficient  Configuration  -  Electronic  Control  Unit  (ECU) 
provides  control,  auto- tracking,  and  failure  management 
as  well  as  actuator  drive  control  to  effect  an  operation¬ 
ally,  self-contained,  actuation  system. 

•  Self-Contained  Features  -  allows  the  V4-ACC  to  be  used  as 
a  part  of  a  distributed  control  system  as  well  as  a 
centrally  controlled  actuation  system. 

•  EMP  Tolerance  Potential  -  location  of  an  ECU  as  an  inte¬ 
gral  part  of  the  actuator  assembly  allows  the  housing  to 
be  used  to  reduce  vulnerability  to  man-made  and  meteoro¬ 
logical  electrical  interferences. 

Application  -  V4-ACC  can  be  used  in  almost  any  helicopter 
or  fixed  wing  control  system. 


2.  INTRODUCTION 


2 . 1  GENERAL  BACKGROUND 

To  be  effective,  a  Navy  helicopter  needs  the  capability  of 
terminal  operation  from  the  deck  of  a  ship  under  adverse 
visibility  and  wind  conditions.  The  approach  and  touch-down 
part  of  the  operation  presents  a  much  greater  problem  than 
taking  off.  It  can  be  divided  into  three  phases:  approach; 
close-in  approach  and  hover;  and  touchdown.  One  solution  to 
the  problem  is  to  use  a  fly-through,  fault-tolerant  Automatic 
Flight  Control  System  (AFCS)  with  sophisticated  cockpit  dis¬ 
plays.  A  second  solution  is  to  use  a  full-authority,  fault- 
tolerant  AFCS  with  automatic  landing  capability,  but  leaving 
the  pilot  with  override  capability  and  less  sophisticated 
displays  for  monitoring  the  landing  operation.  This  program 
is  directed  toward  validating  the  V4-ACC  inco^orating  an 
auxiliary  mechanical  reversion  mode  as  a  candidate  actuation 
system  for  an  AUTOLAND  program. 

The  V4-ACC  was  initially  investigated  to  determine  feasibil¬ 
ity,  and  later  evaluated  for  two  other  applications  in  addi¬ 
tion  to  AUTOLAND.  Feasibility  of  the  concept  was  determined 
under  a  Bell  Helicopter  Textron  (BHT)  IR&D  program.  This 
program  was  followed  by  a  contract  with  the  Naval  Air  Develop¬ 
ment  Center  to  evaluate  the  V4-ACC  for  use  as  a  fault-toler¬ 
ant,  high  authority,  series-type  actuator  in  the  Navy  ship¬ 
board  landing  program.  In  a  later  contracted  program  with 
NASA/Ames,  the  concept  was  used  in  the  predesign  of  a  FBW 
system  for  the  XV-15  tilt  rotor  aircraft.  In  addition  to  the 
predesign,  the  program  included  the  design,  fabrication,  and 
laboratory  testing  of  the  V4-ACC  for  use  in  the  collective 
control  channel  of  the  XV-15.  This  concept  has  been  labora¬ 
tory  tested  and  performed  exceptionally  well.  It  could  be 
installed  using  the  existing  mounting  points  in  the  XV-15,  and 
is  operationally  equivalent  to  the  existing  collective  actua¬ 
tor. 

The  engineering  accomplished  during  the  above  programs  has 
yielded  a  technology  base  that  warrants  going  directly  into 
the  development  of  a  flight  test  model  of  the  V4-ACC.  The 
AH-IS  helicopter  has  been  investigated  as  a  possible  candidate 
for  the  test  helicopter.  The  findings  were  very  favoredile  in 
that  the  V4-ACC/mechanical  system  can  be  installed  as  a  re¬ 
placement  for  the  existing  AH-lS  actuators  without  major 
modification.  Also,  the  AH-lS  helicopter  is  considered  to  be 
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a  "low  maintenance"  helicopter  and  would  therefore  be  a  com¬ 
paratively  low  cost  flight  test  vehicle. 

2.2  SUMMARY  DESCRIPTION  OF  THE  4-VALVE  ACTUATION  CONTROL  CON¬ 
CEPT 

A  summary  description  of  the  V4-ACC  has  been  included  in  this 
section  to  facilitate  the  presentation  of  the  material  in  the 
subsequent  sections.  A  more  detailed  description  of  the 
concept  is  provided  in  Appendix  A. 

The  V4-ACC  is,  to  some  degree,  an  operationally  self-contained 
actuation  system.  Each  ECU  is  dedicated  to  a  specific  actua¬ 
tor  and  hence  can  be  installed  at  or  in  the  actuator.  The  ECU 
operates  in  conjunction  with  the  actuator  to  effect  a  self- 
contained  function  in  that  it  drives  the  actuator  in  a  closed- 
loop  configuration  as  well  as  provides  automatic  tracking  and 
redundancy  management  of  the  quad-redundant  control  paths. 

The  V4-ACC  uses  four  active  electrical  control  paths  to  con¬ 
trol  a  dualized  hydraulic  actuator.  A  simple  failure  manage¬ 
ment  unit  operates  in  conjunction  with  some  of  the  inherent 
features  of  the  basic  system  to  provide  a  Failure  Tolerance 
Level  (FTL)  for  the  control  paths  of  dual  fail-operate .  This 
actuation  system  is  characterized  by  fundamental  simplicity 
and  its  inherent  ability  to  tolerate  failures;  it  is  in  es¬ 
sence  a  forgiving-type  system. 

The  electronic  control  paths  can  be  analog,  digital,  or  digi¬ 
tal/optical  and  use  Electrohydraulic  Servovalves  (EHSV)  for 
direct  interfaces  with  the  two  primary  cylinders.  Each  con¬ 
trol  channel  uses  four  electrical  links  (2  per  piston),  four 
electronic  drivers,  four  failure  management  units,  and  a  dual 
primary  hydraulic  actuator  (tandem  or  parallel).  In  a  flight 
test  model,  all  control  channels  would  be  operated  with  a 
control/reporting  panel  located  in  the  cockpit. 

This  system  offers  the  following  features: 

Single  fail-operate  is  inherent  (without  failure  manage¬ 
ment  ) . 

•  Dual  fail-operate  provided  by  adding  a  simple  failure 
management  system. 

Electrohydraulic  servovalves  provide  a  direct  interface 
between  the  electrical  links  and  the  power  cylinder  (no 
drive  actuation  function  required). 
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Provides  automatic  tracking  of  the  multiple  electrical 
control  links. 

Includes  unique  feature  for  protection  against  intermit¬ 
tent  type  inputs  (e.g.,  electrical  transients)  that  could 
effect  an  unwarranted  disengagement. 

•  Easily  retrofitted  using  the  mounting  points  of  the 
existing  actuator. 

Has  application  to  high-performance  airplane  controls  as 
well  as  helicopter  controls. 

•  Is  essentially  "self-contained"  and  can  be  driven  di¬ 
rectly  by  the  pilot  through  electrical  links  or  other 
control  media. 

A  simplified  schematic  of  a  tandem  dual  actuator  and  the 
driving  circuit  is  shown  in  Figure  5.  All  electrical  control 
paths  operate  simultaneously  and  are  automatically  tracked  to 
provide  the  desired  stiffness  at  null.  The  tracking  signals 
are  inherently  generated  in  the  failure  sensing  circuitry  in 
the  failure  management  system. 

The  failure  management  system  uses  position  sensors  on  the 
porting  stage  of  the  EHSV  (see  Figure  5)  to  provide  the  intel¬ 
ligence  needed  for  the  failure  logic.  The  failure  circuitry 
uses  a  simple  logic  for  failure  detection  and  has  the  intelli¬ 
gence  to  differentiate  between  an  inert-type  failure  and  a 
hard- type  failure.  Protection  against  an  unwarranted  dis¬ 
engagement  of  a  control  path  (i.e.,  apparent  intermittent 
failure)  has  been  included  for  protection  against  induced 
transients. 

Figure  2  is  a  photograph  of  the  laboratory  test  model  of  the 
V4-ACC  configured  for  dual  fail-operate  application.  As  de¬ 
scribed  later,  this  hardware  was  used  in  the  program  to  evalu¬ 
ate  the  V4-ACC  with  a  mechanical  back-up  as  part  of  a  candi¬ 
date  control  system  for  use  in  automatic  shipboard  landing 
systems . 

2.3  DESCRIPTION  OF  ACTUATION  SYSTEM 

The  actuation  system  is  shown  in  simple  block  diagram  form  in 
Figure  1  and  in  more  detail  in  Figure  6.  Reference  can  be 
made  to  Figures  2,  3,  and  4  to  establish  a  physical  relation¬ 
ship  between  the  "blocks"  in  Figures  1  and  6  and  the  actual 
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equipment.  The  test  model  of  the  actuation  system,  as  shown 
in  Figure  6,  consists  of  the  basic  equipment  listed  below. 

•  Control/Aimunciator  Panel 

•  FBW/Controller  and  Electrical  Links 

•  Mechanical  Control  Unit 
FBW/Mechanical  Actuator  Assembly 

In  accordance  with  the  test  program  requirements,  these  equip¬ 
ments  were  installed  on  a  test  stand  and  evaluated  as  an  inte¬ 
grated  system.  The  test  stand  was  equipped  with  a  load  actua¬ 
tor,  28  Vdc  supply,  and  a  1500  psi  hydraulic  supply  (see 
Figure  2 ) .  Each  control  path  includes  a  dedicated  4  KHz  ac 
supply  and  a  regulated  14  Vdc  supply  which,  for  the  laboratory 
test,  was  derived  from  the  28  Vdc  on  the  test  stand. 

The  Control/Annunciator  Panel  is  equipped  so  that  the  control 
paths  (la,  lb,  2a,  and  2b)  can  be  engaged  and  disengaged 
individually.  This  panel  is  also  equipped  to  display  the 
engage/disengage  status  of  each  control  path.  After  engage¬ 
ment  of  one  or  more  of  the  control  paths,  the  V4-ACC/mechani- 
cal  system  is  slaved  to  the  FBW  controller.  The  mechanical 
controller  will  inherently  follow  the  actuator  since  it  is 
physically  connected  through  the  mechanical  linkage  and  me¬ 
chanical  control  head.  Hence,  it  is  always  in  a  synchronized 
position  in  the  event  of  a  reversion  from  FBW  to  mechanical 
control.  Reversion  is  accomplished  with  the  manually  operated 
switch  on  the  mechanical  controller.  Reversion  automatically 
occurs  if  all  FBW  control  paths  are  disengaged.  The  system 
process  can  be  mentally  integrated  into  an  operable  system  by 
following  through  a  step-by-step  operation. 

With  the  quad  FBW  control  paths  engaged,  assume  a  pilot  input 
from  the  FBW  controller.  The  four  analog  signals  are  ampli¬ 
fied  by  the  actuator  drive  circuitry  in  the  ECU  and,  in  turn, 
simultaneously  drive  the  four  EHSVs  which  port  fluid  into  the 
actuator  cylinders.  The  actuator  moves  until  the  four  LVDT 
actuator  position  feedback  transducers  produce  signals  that 
cancel  the  four  pilot  input  signals.  Continuous  tracking  and 
failure  monitoring  of  the  control  paths  are  provided  by  the 
Auto-Track  and  Failure  Management  Block  in  the  ECU.  If  a 
control  path  fails,  it  is  disengaged  and  annunciated  to  the 
pilot.  If  a  second  failure  should  occur,  it  is  likewise 
disengaged.  In  the  event  of  a  third  failure,  the  operable 
control  path,  as  well  as  the  failed  path,  will  probably  dis¬ 
engage.  The  system  will  sense  and  disengage  some  third  fail¬ 
ures  without  disengaging  the  remaining  operable  control  path, 
e.g.,  an  open  EHSV  coil. 
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If  the  copilot  elects  to  take  over,  the  "kill  switch"  on  ^e 

mechanical  controller  is  depressed.  This  that  ^ 

the  isolation  stage  of  the  hybrid  mechanical  valve  ^at 
switches  the  hydriulic  flow  control  from  the  FBW  mod^e  to  the 
mechanical  control  valves.  As  pointed  out  earlier,  ^e  con 
version  to  mechanical  control  is  automatic  if  the  quad  control 
paths  are  disengaged. 

The  basic  equipments  mentioned  above  and  shown  in  Figure  6  are 
described  in  more  detail  in  Section  3. 
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3.  TASK  DESCRIPTION 


The  work  covered  in  this  section  is  for  the  procurement  of 
hardware,  design,  fabrication,  and  test  of  a  laboratory  test 
model  of  a  FEW  actuation  system  equipped  with  an  auxiliary 
(back-up)  mechanical  control  system.  The  test  includes  inte¬ 
gration  of  the  equipments,  failure  modes  and  effects  analysis, 
and  evaluation  relative  to  use  in  automatic  shipboard  landing 
systems .  The  work  was  accomplished  as  described  below  in  the 
work  statement. 

3.1  DESIGN  TASK  (0001) 

3.1.1  Design  of  the  Basic  Configuration  of  the  Control/Actua- 
tion  System 

The  V4-ACC/mechanical  system  was  designed  to  functionally 
operate  as  described  in  Section  2.3.  It  was  functionally 
configured  as  shown  in  Figure  6  and  physically  configured  as 
pictorally  shown  in  Figure  2,  Some  of  the  equipments  and  the 
test  stand  from  the  earlier  program  were  modified  and  used 
cost  reduction.  The  laboratory  test  configuration  included 
the  equipments  listed  below: 

•  V4-ACC/mechanical  system 

•  Electronic  control  unit 

•  Load  actuator  and  control  circuitry 

•  Safety  pilot's  mechanical  controls 

•  Pilot's  FEW  control  assembly 

•  Control/annunciator  panel 

•  Test  stand 

Narration  and  illustrations  are  used  in  the  following  subsec¬ 
tions  to  describe  the  physical  and  operational  characteristics 
of  the  above  equipments. 


22 


3.1.2  Design  of  Required  Ecruipments 

3. 1.2.1  V4-ACC/Mechanical  System.  The  V4-ACC  used  in  the 
previous  program  was  provided  to  minimize  cost.  A  modifica¬ 
tion  design  was  required  to  configure  this  actuator  into  a 
V4-ACC/mechanical  system  suitable  for  use  in  this  program. 

A  plan  view  of  the  V4 -ACC/mechanical  system  and  associated 
test  hardware  is  shown  in  Figure  7.  Fi^re  8  is  a  hydraulic 
schematic  of  the  basic  actuator,  mechanical  control  head,  and 
the  V4-ACC  module.  As  shown  in  this  figure,  the  mechanical 
control  head  consists  of  the  conventional  spool  and  sleeve 
assembly  and  two  mode  select  valves.  The  spool  and  sleeve 
assembly  includes  the  mechanical  input  and  its  output  ports 
are  connected  to  the  mode  select  valves.  The  two  mode  select 
valves  are  also  connected  to  the  output  ports  of  the  V4-ACC 
module.  Two  solenoids  are  used  to  hydraulically  operate  the 
two  mode-select  valves  to  effect  mechanical  reversion.  Me¬ 
chanical  reversion  occurs  if  the  pilot  depresses  the  kill 
switch,  if  all  FBW  control  paths  are  disengaged,  or  if  all 
electrical  power  is  cut  off. 

The  hybrid  actuator  is  depicted  schematically  as  an  integral 
part  of  the  actuation  system  in  Figure  6  and  pictorially  shown 
in  Figure  4.  This  actuator  was  configured  in  the  most  econom¬ 
ical  manner  to  provide  a  laboratory  model  that  would  satisfy 
the  functional  requirements.  Physically,  however,. the  final¬ 
ized  version  would  be  significantly  different.  In  later 
prototypes,  the  components  in  the  V4-ACC  module  could  be 
integrated  into  the  barrel  of  the  actuator.  Also,  the  me¬ 
chanical  control  head  could  be  considerably  reduced  and  would 
not  have  the  exposed  plumbing  as  can  be  seen  in  Figure  4. 

As  shown  in  Figure  6,  the  hydraulic  supplies  are  connected  to 
the  mode  select  stage  of  the  mechanical  valve.  The  mode 
select  stage  contains  valving  that  blocks  the  ports  of  the 
mechanical  valve  (see  Figure  8)  while  operating  in  the  FBW 
mode.  The  kill  switch  is  connected  to  control  an  electro- 
hydraulic  solenoid  that,  in  turn,  controls  the  position  of  the 
mode  select  valving.  In  the  FBW  mode,  the  solenoid  is  ener¬ 
gized.  Mechanical  reversion  is  obtained  by  three  means: 
depressing  the  kill  switch,  disengagement  of  the  quad  control 
paths,  or  loss  of  all  electrical  power.  Operation  of  the  kill 
switch  or  loss  of  electrical  power  disengages  the  control 
paths  which,  in  turn,  automatically  operate  their  respective 
mode  select  valves  that  blocks  the  EHSV  ports  so  that  the 
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Figure  7.  Plan  View  of  Actuator  Installation  and  Control 
Link  Mechanism. 


Hydraulic 


fluid  does  not  have  a  path  around  the  pistons.  A  flight  test 
version  will  include  a  standby  hydraulic  system  and  probably 
some  redundancy  in  the  mechanical  reversion  process . 

3. 1.2. 2  Electronic  Control  Unit.  The  electronic  package 
configuration  was  designed  to  facilitate  the  laboratory  test 
program.  The  circuitry  was  designed  also  to  accommodate  the 
laboratory  test;  however,  it  is  considered  suitable  for  use  in 
a  flightworthy  model.  A  flightworthy  version  can  be  obtained 
by  conformal  coating  the  circuit  boards  shown  in  Figure  3  and 
then  repackaging  the  boards  into  a  configuration  more  suitable 
for  flight  test. 

The  unit  is  depicted  in  Figure  6  as  a  functional  part  of  the 
actuation  system.  Figure  3  is  a  photograph  of  a  laboratory 
model  of  this  unit,  and  Figure  9  is  a  detail  circuit  schematic 
of  the  circuitry  for  one  control  path;  hence,  each  of  the  four 
circuit  boards  displayed  in  Figure  3  represents  the  electron¬ 
ics  required  for  one  control  path.  Each  circuit  board  in¬ 
cludes  a  dedicated  4  KHz  ac  supply;  dedicated  14  Vdc  supply; 
drive  circuitry  for  the  EHSV;  high  gain  position  feedback  loop 
around  the  EHSV;  automatic  tracking  loop  for  synchronizing  the 
EHSV  with  the  other  operating  EHSVs;  failure  management  cir¬ 
cuitry  for  the  respective  control  paths;  and  outgoing  vote 
signals  to  the  other  circuit  boards.  The  circuit  boards  also 
include  test  circuitry  for  simulating  failures  needed  for  the 
Failure  Modes  and  Effects  Analysis  (FMEA)  test. 

EHSV  Drive  Circuitry.  As  shown  in  Figure  9,  the  drive  signal 
for  the  EHSV  follows  the  path:  2ia“2lb”®2a”®2b“^^^'^  coil. 

The  gain  of  this  path  is  set  up  to  produce  100  percent  flow 
from  the  EHSV  for  four  percent  pilot  input.  This  flow  gain 
should  be  adequate  if  only  one  control  path  on  each  piston  is 
operating. 

EHSV  Position  Feedback  Loop.  The  high  gain  feedback  loop 
around  the  EHSV  follows  the  path:  EHSV  position  feedback 
(LVDT)  -  Q8-Q6b"23a’23b“22a’22a"22b-^^^^  feedback 

loop  reduces  the  effects  of  hysteresis,  null  shift,  threshold, 
and  nonlinearity.  The  loop  has  been  designed  to  reduce  these 
characteristics  by  a  factor  of  5;  e.g.,  five  percent  hystere¬ 
sis  effect  would  be  reduced  to  one  percent.  The  intent,  of 
course,  is  to  improve  the  valve  characteristics  as  well  as  to 
obtain  a  better  match  of  the  four  valves.  The  payoff  is  that 
manufacturing  tolerances  of  off-the-shelf  valves  are  accept- 
ed3le  for  the  V4-ACC.  This  valve  matching  plus  the  automatic 
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Figure  9.  Detail  Circuit  Schematic  of  Control  Path  la. 


tracking  loops  provide  a  primary  actuator  with  a  well  defined 
null  with  controllable  characteristics  if  desired. 

Automatic  Tracking  Loon.  The  automatic  tracking  loop  follows 
the  path:  Sense  Resistor  -  Q4a“Q4b“23b"22a“22b“^^^^  coil. 

The  error  signal  across  the  sense  resistor  represents  the 
level  of  disagreement  of  the  EHSV  of  the  respective  control 
path  and  the  other  EHSVs.  This  loop  operates  at  a  high  gain 
and  can  provide  valve  track  out  past  the  main  rotor  frequen¬ 
cies  (1/rev,  2/rev,  etc.).  The  control  of  the  tracking  signal 
is  limited  to  an  equivalent  of  about  fifty  percent  EHSV  dis¬ 
placement.  That  is,  the  dynamic  track  range  of  the  track  loop 
is  equivalent  to  fifty  percent  of  EHSV  stroke  or  about  two 
percent  of  primary  actuator  stroke  (depending  on  the  actuator 
position  loop  gain).  If  the  track  signal  exceeds  the  limit 
but  is  less  than  the  value  required  for  displacement,  it  is 
considered  a  "soft-failure"  and  should  be  annunciated  as  such. 


Failure/Manaqement  Loop.  The  failure/management  loop  follows 
the  path:  Sense  Resistor  -  Q^^-Qg^-Qgj^-Q^^-Q.^-Disengage 


Relay  -  Engage/Disengage  Solenoid  Valve.  Q 


5a'  ^5b' 


the  diodes 


and  resistors,  constitute  a  double-ended  threshold  circuit. 
The  resistor  pad  establishes  the  threshold.  If  the  signal 
exceeds  the  threshold,  swings  from  ground  potential  to  28 


Vdc  which  provides  a  back  bias  to  the  diode  which  allows  the  1 
|jf  capacitor  to  start  charging  through  the  470K  resistor. 

When  the  capacitor  charges  to  the  14  Vdc  level,  swings 


from  ground  potential  to  28  Vdc.  This  turns  off  Qy  which 

disengages  the  engage/disengage  relay  and,  in  turn,  the  en¬ 
gage/disengage  electrohydraulic  solenoid.  The  solenoid  cuts 
the  hydraulic  pressure  off  to  the  associated  slide  valve  in 
the  FEW  hydraulic  module  which  isolates  the  failed  control 
path.  The  above  RC  timing  circuit  effects  a  time  inhibit  of 
0.25  second.  The  reset  time  for  this  circuit  is  about  0.00025 
second.  The  purpose  of  this  circuit  is  to  protect  against 
electrical  interferences;  the  time  delay  requires  the  inter¬ 
ference  to  be  present  for  a  set  time  while  the  quick  reset 
prevents  the  time  circuit  from  integrating  a  series  of  short 
interferences . 


Inert  Failure  Protection.  As  shown  in  Figure  9,  14  Vdc  is 
used  as  the  reference  voltage;  i.e.,  all  the  signals  are 
referenced  to  the  14  Vdc  supply  and  hence  swing  ±  about  this 
reference.  The  circuitry  has  been  designed  so  any  open  or 
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short  of  the  signal  up  to  the  EHSV  coil  creates  a  hard  signal 
and  will  effect  a  disengagement  of  the  respective  control 
path.  An  open  of  the  EHSV  coil,  however,  results  in  an  inert 
type  failure.  This  type  failure  is  not  easily  detected  while 
flying  in  smooth  air  since  the  EHSVs  are  not  being  appreciably 
displaced  from  null  and  the  disagreement  with  the  failed 
control  path  and  the  operable  control  paths  is  comparatively 
small.  Low  disengagement  thresholds  would  have  to  be  used  to 
assure  that  a  coil  failure  would  be  sensed  and  result  in  a 
subsequent  disengagement  of  the  associated  control  path.  Low 
thresholds,  however,  make  the  system  vulnerable  to  false 
failure  type  disengagements  and  it  was  elected  to  incorporate 
an  additional  simple  circuit  to  monitor  the  EHSV  coil.  This 
circuit  consists  of 


and  the  associated  circuit 


hardware  in  Figure  9.  It  operates  as  an  adjunct  to  the  basic 
failure/management  system  in  that  it  can  sense  EHSV  coil 
failures  and  can  output  a  fail  signal  to  to  effect  a 

disengagement  of  the  associated  control  path. 


An  improved  EHSV  coil  monitor  concept  that  will  sense  a 
"shorted"  coil  as  well  as  an  "open"  coil  has  been  recently 
conceived.  It  was  not  incorporated  into  the  hardware  since  it 
was  conceived  after  the  laboratory  test  had  been  completed. 

The  improved  concept  is  a  simple  modification  of  the  existing 
monitor  and  is  presented  below  as  supplemental  information. 

The  improved  version  of  the  EHSV  coil  monitor  is  shown  in 
Figure  10.  The  driver  signal  is  amplified  and  processed 
through  two  paths  to  Qg^-  For  normal  operation  the  gains  of 

Path  No.  1  and  Path  No.  2  are  the  same  and,  hence,  the  output 
of  Qg^  is  essentially  zero.  An  appreciable  difference  in  the 

gains  of  the  two  paths  will  produce  an  output  from  Qg^  when  a 

driver  signal  is  present.  If  this  output  exceeds  the  set 
threshold  (4  Vdc),  Qgj^  will  output  a  hard  signal  that  operates 

through  a  time  constant  to  provide  a  discharging  signal  to  the 
basic  failure/management  unit.  For  example,  the  coil  has  a  dc 
impedance  of  2000  ohms  and  if  it  opens,  the  gain  of  Path  No.  1 
is  high  compared  to  Path  No.  2  (by  a  factor  of  80/6)  and  will 
effect  a  disengagement  when  there  is  an  adequate  driver  sig¬ 
nal.  On  the  other  hand,  if  the  coil  is  shorted.  Path  No.  2 
has  a  higher  gain  (by  a  factor  of  3)  and  will  effect  a  dis¬ 
engagement  when  there  is  an  adequate  driver  signal .  Obvi¬ 
ously,  for  the  latter  condition  it  will  require  a  larger 


29 


I  EHSV  COIL  MONITOR 


>- 

OH 

\— 

3 

— 

o 

z 

X 

UJ 


Figure  10.  Open/Ghort  ElISV  Coil  Monitor. 


signal  to  effect  a  disengagement;  for  the  gains  as  shown  it 
would  require  a  driver  signal  of  6  volts.  This  is  equivalent 
to  about  two  percent  pilot  input  and  does  not  present  a  prob¬ 
lem  since  it  will  disengage  on  demand  for  flow. 

Outgoing  Vote  Signals.  These  three  signals  paths  are  used  to 
inform  the  other  control  paths  of  the  position  of  EHSV  la. 
Each  of  the  other  control  paths  will  use  this  information  to 
establish  a  vote  in  the  same  manner  that  control  Path  la  uses 
the  incoming  signals  from  the  other  three  control  paths  iden¬ 
tified  as  "Incoming  Vote  Signals"  in  Figure  9.  A  detailed 
description  of  the  voting  technique  is  covered  in  Appendix  A. 

FMEA  Test  Circuitry.  Test  circuitry  has  been  included  on  the 
circuit  boards  to  simulate  failures  within  the  ECU.  This  in¬ 
cludes  simulation  of  a  hard  signal  failure,  hard  short  pulse, 
inert  failure  management  circuitry,  and  open  EHSV  coil  fail- 


The  fault  simulator  in  the  lower  left  corner  of  Figure  9  is 
used  to  generate  the  hard  signal  failure  and  hard  short  pulse. 
A  transient- type  error  signal  is  generated  by  positioning  SW3 
to  "la,"  SW2  to  PULSE,  and  momentarily  depressing  SWl.  This 
generates  0.2  second,  28  volt  pulse.  Since  the  disengage  time 
delay  is  0.25  second,  the  0.2  second  pulse  should  not  effect  a 
disengagement.  The  hard  fail  signal  is  generated  by  position¬ 
ing  SW2  to  HARD.  This  applies  a  28  volt  error  signal  to  the 
test  signal  input  and  should  effect  a  disengagement  of  Control 
Path  la.  SW3  can  be  positioned  to  2a  to  generate  a  second 
failure. 

SW4  in  the  lower  center  of  Figure  9  is  used  to  simulate  an 
inert  type  failure  in  the  failure  management  circuitry. 
Positioning  this  switch  to  the  fail  position  "shorts"  the 
failure  signal  to  ground  and  hence  causes  a  loss  of  the  fail¬ 
ure  management  function  for  Control  Path  la.  With  this  condi¬ 
tion  existing,  a  failure  in  Control  Path  la  will  not  effect  a 
disengagement;  the  basic  system,  however,  will  tolerate  one 
failure  and  continue  working  as  discussed  in  Appendix  A. 

SW5  in  the  right  center  of  Figure  9  is  used  to  simulate  an 
open  EHSV  coil.  Positioning  this  switch  to  the  open  position 
will  effect  a  disengagement  as  discussed  earlier  under  Inert 
Failure  Protection  in  this  section. 


3. 1.2. 3  Load  Actuator  and  Control  Circuitry.  The  load  actua¬ 
tor  and  associated  electronic  control  circuitry  used  in  the 
previous  program  were  transferred  to  this  program.  These 
equipments  were  used  without  major  modification. 

The  load  actuator  and  associated  control  circuitry  are  identi¬ 
fied  in  Figure  2 .  Figure  7  shows  how  the  load  actuator  is 
connected  to  the  V4-ACC/mechanical  system.  It  has  a  larger 
piston  area  and  can  therefore  stall  the  hybrid  actuator. 
Maximiun  force  is  accomplished  by  adjusting  the  supply  pres¬ 
sure.  The  electronic  control  circuitry  operates  in  conjunc¬ 
tion  with  the  load  actuator  to  effect  a  simple  position  feed¬ 
back  control  system. 

3. 1.2. 4  Safety  Pilot's  Mechanical  Controls.  A  conventional 
cyclic  control  stick  and  grip  are  used  in  conjunction  with 
simple  linkage  to  provide  the  mechanical  back-up  control 
function  (see  Figures  2  and  7).  The  cyclic  stick  and  control 
linkages  used  in  the  previous  program  were  modified  and  used 
as  shown  in  the  mentioned  figures. 

3. 1.2. 5  FBW  Controller  and  Electric  Links.  The  FEW  control¬ 
ler  consists  of  a  simple  lever  connected  to  two  dual,  film 
potentiometers  (see  Figures  1  and  2).  A  flight  test  model 
would  obviously  use  a  suitably  configured  FBW  controller  and 
four  independent,  inductive-type  transducers.  For  conveni¬ 
ence,  the  transducers  are  excited  from  a  single-source  elec¬ 
trical  supply.  The  output  signals  are  connected  to  the  ECU 
and,  in  turn,  are  amplified  and  used  as  the  drive  signals  for 
the  actuator . 

3. 1.2 .6  Control/Annunciator  Panel.  This  panel  is  an  integral 
part  of  the  ECU  as  shown  in  Figure  3.  Functionally,  it  con¬ 
sists  of  four  independent  panels,  one  for  each  control  path. 
Each  panel  consists  of  button-type  engage  and  disengage 
switches,  engage  and  disengage  annunciators,  and  a  momentary 
switch  for  simulating  electrical  transients  and  "hard"  fail¬ 
ures  . 

3. 1.2. 7  Test  Stand.  The  test  stand  is  shown  in  Figure  2  with 
the  laboratory  test  installation  of  equipment.  Fi^re  7  is  a 
plan  view  of  the  test  stand,  actuators,  and  mechanical  con¬ 
trols.  The  test  stand  existed  but  modification  was  necessary 
to  accommodate  the  mechanical  control  linkages.  Also,  two 
electrohydraulic  solenoids  were  added  for  the  mechanical 
reversion  feature. 
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3.2  PROCUREMENT  TASK  (0002) 

3.2.1  V4-ACC/Mechanical  System 

The  services  and  material  for  the  modification  of  the  existing 
V4-ACC  were  procured  from  Hydraulic  Research  Textron  in  ac¬ 
cordance  with  a  BHT  specification.  This  procurement  was  at  no 
cost  to  the  contract. 

3.2.2  Mechanical  Hardware 

Existing  mechanical  hardware  was  used;  no  procurement  was  re¬ 
quired. 

3.2.3  Electrical  Hardware 

This  program  required  the  procurement  of  photographic  services 
for  the  circuit  boards,  integrated  circuits,  discrete  transis¬ 
tors,  relays,  switches,  capacitors,  resistors,  etc. 

3.3  FABRICATION  TASKS  (0003) 

3.3.1  Test  Stand 

The  existing  test  stand  used  in  the  previous  program  was 
modified  to  accommodate  the  new  equipment.  The  modification 
to  the  basic  test  stand  was  very  minor.  Some  new  installation 
hardware  was  required  for  the  V4-ACC/mechanical  system  and  the 
control  linkages.  The  linkages  were  configured  so  that  the 
existing  cyclic  stick  could  be  used.  Figure  7  is  a  plan  view 
of  the  test  stand  and  shows  the  V4- ACC/mechanical  system 
installation  and  the  control  linkages.  Reference  should  also 
be  made  to  Figure  2,  which  is  a  pictorial  presentation  of  the 
test  stand  and  the  equipment. 

3.3.2  Mechanical  Controls  and  V4-ACC/Mechanical  System 

The  V4-ACC/mechanical  system  installation  and  the  mechanical 
control  linkages  are  shown  in  Figure  7.  Reference  can  also  be 
made  to  Figure  2,  which  is  a  pictorial  presentation  of  the 
installed  equipment.  The  control  linkage  installation  in¬ 
cluded  an  adjustable  friction  device  to  prevent  having  a  "limp 
stick"  when  the  controls  are  switched  from  FBW  to  mechanical 
back-up . 


3.3.3  Electronic  Hardware 


The  electronic  hardware  was  fabricated  as  shown  in  Figures  2 
and  3.  As  shown,  the  electrical  control  and  annunciator 
functions  were  fabricated  as  an  integral  part  of  the  ECU. 

Also,  the  test  switches  and  associated  circuitry  used  for 
simulating  failures  were  fabricated  as  a  part  of  the  ECU.  The 
ECU  was  fabricated  as  shown  in  Figure  3  to  facilitate  testing 
the  laboratory  model.  The  four  circuit  boards  are  flight¬ 
worthy  and  hence  can  be  repackaged  and  used  in  a  flight  test 
program. 

3.4  EQUIPMENT  INTEGRATION  TASK  (0004) 

The  Integration  Test  Plan  was  prepared  as  a  contracted  item 
and  has  been  included  in  the  Appendices  as  a  deliverable  item. 
Some  minor  circuit  changes  have  been  incorporated  in  the  ECU 
since  the  test  plan  was  submitted  for  approval.  The  test 
instructions  have  been  updated  accordingly  and  included  in 
this  section  along  with  the  associated  results  of  each  test. 
Figures  6  and  9  can  be  used  to  supplement  the  stated  test  and 
results . 

Scope 

This  test  program  included  the  integration  and  test  of  the  FBW 
control  mode  as  well  as  the  mechanical  reversion  mode.  It 
covers  the  alignment,  functional  test,  operational  suitability 
test,  and  FMEA. 

3.4.1  Functional  Test 

3. 4. 1.1  Hybrid  Actuator  Mechanical  Control .  With  hydraulic 
power  on  and  FBW  module  disengaged,  move  pilot's  controls  from 
stop  to  stop  and  qualitatively  check  for  operational  suitabil¬ 
ity.  Note  dead  spots,  thresholds,  breakout  forces,  etc.  Turn 
off  Supply  No.  1;  Supply  No.  2  should  automatically  take  over. 
Apply  pressure  to  load  actuator,  and  with  an  appreciable 
amount  of  load,  move  actuator  from  stop-to-stop  to  assure 
proper  operation. 

Results .  The  primary  actuator  operated  in  a  normal  manner. 
Other  than  some  slop  that  was  attributed  to  the  loose  "fit"  of 
the  cyclic  stick,  the  motion  was  smooth  and  had  no  discernable 
dead  spots. 
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3. 4. 1.2  Hybrid  Actuator  FEW  Control.  The  loop  gains  and 
compensation  networks  are  essentially  the  same  as  were  used  in 
the  previous  program.  There  are  some  changes,  however,  in 
circuit  configuration,  and  it  is  necessary  to  realign  the 
control  paths.  Each  control  path  is  to  be  aligned  and  tested 
separately  under  the  conditions  outlined  below,  which  have 
been  changed  as  required  to  accommodate  the  changes  in  circuit 
configuration.  Reference  should  be  made  to  Figure  9  for 
supplemental  information.  It  is  pointed  out  that  the  opera¬ 
tional  amplifiers  are  operated  from  +28  Vdc  to  ground  with  +14 
Vdc  as  the  common. 

3. 4. 1.2.1  Alignment  and  Test  of  Control  Paths 
4  KH2  Supply 

Conditions ;  Electrical  power  ON 

•  Connect  oscilloscope  to  TPl  and  adjust  Pot  1  to 
effect  a  uniform  sine  wave  output.  Output 
should  be  approximately  3  volts  rms.  There  is 
no  amplitude  adjustment.  Adjust  all  four  4  KHz 
supplies . 

Results;  All  supplies  adjusted  to  obtain  sine  wave 
output.  The  voltage  magnitudes  are  recorded  below. 

4  KHz  Supply  la  -  2.95  Vrms 
4  KHz  Supply  lb  -  2.92  Vrms 
4  KHz  Supply  2a  -  2.91  Vrms 
4  KHz  Supply  2b  -  2.97  Vrms 

14  Vdc  Regulated  Supply 

Conditions :  Electrical  power  ON 

•  Connect  voltmeter  to  TP2  and  adjust  Pot  2  to 
obtain  +14  Vdc.  Adjust  all  four  supplies. 


Results ;  Voltage  magnitudes  of  the  supplies  were 
adjusted  to  obtain  the  voltages  recorded  below. 


DC  Supply  la 
DC  Supply  lb 
DC  Supply  2a 
DC  Supply  2b 


13.99  Vdc 
13.99  Vdc 
13.99  Vdc 
13.99  Vdc 
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Control  Path  la 

Conditions :  Hydraulic  power  ON 
Electrical  power  ON 
TP4  shorted  to  14  Vdc 

EHSV  Feedback  Loops 

The  purpose  of  this  loop  is  to  improve  the  linearity 
of  the  EHSVs  as  well  as  to  reduce  hysteresis  effect, 
null  shift,  and  thresholds. 

•  Adjust  Pot  3  to  null  TP3  (referenced  to  +14 
Vdc).  This  adjustment  is  performed  with  the 
EHSV  position  feedback  loop  closed  which  com¬ 
pensates  for  any  electrical  null  shift  caused 
by  the  circuitry,  EHSV  coil,  or  misalignment  of 
the  position  feedback  transducer  (LVDT  or 
EHSV).  The  adjustment  aligns  the  electrical 
null  with  the  assumed  mechanical  null  of  the 
EHSV  which  is  accurate  to  ±two  percent  of  total 
EHSV  output. 

Results ;  Pot  3  was  adjusted  to  null  TP3 .  This 
adjustment  also  compensates  for  offsets  caused  by 
the  tracking  loop. 

Freguency  Response  Test 

Conditions ;  Hydraulic  power  ON 
Electrical  power  ON 
Shorted  TP4  to  14  Vdc 

•  Connect  frequency  generator  to  the  Test 
Input  (pin  18) 

•  Conduct  closed  loop  freguency  response  on 
EHSV  la  by  incrementally  varying  frequency 
of  input  from  zero  to  well  passed  the 
first  break  frequency.  Measure  and  record 
the  magnitude  of  the  input  signal  and  the 
EHSV  LVDT  output  signal . 
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Control  Paths  lb,  2a,  and  2b 


Same  as  Control  Path  la. 

Results :  Closed  loop  frequency  response  data  for 

the  four  EHSVs  are  in  Figures  11a,  11b,  11c,  and 
lid.  As  noted,  the  four  curves  are  essentially 
identical .  This  confirms  that  the  static  and  dy¬ 
namic  characteristics  of  the  control  paths  are  the 
same  and  are  in  accordance  with  the  design. 

3. 4. 1.3  Alignment  of  Electromechanical  Transducers 

Actuator  Feedback  Transducers 


Conditions :  Hydraulic  power  ON 
Electrical  power  ON 
Shorts  on  TP4  removed 
Control  Path  la  engaged 

•  Use  FEW  controller  and  position  V4-ACC  module 
in  increments  and  determine  sensitivity  in 
terms  of  volts  per  inch  of  actuator  travel. 

Results ;  Sensitivity  was  measured  and  recorded  to 
be  3.2  volts-per-inch  of  actuator  travel. 

•  Use  controller  and  drive  V4-ACC  module  in 
increments  and  measure  track  error  between  the 
control  paths. 

Results :  Actuator  position  tracking  data  were 
recorded  from  stop-to-stop  in  five  increments.  The 
readings  for  the  four  actuator  feedback  transducers 
are  presented  in  Table  la.  The  alignment  of  these 
transducers  was  considered  to  be  within  the  control 
range  of  the  auto-tracking  circuitry  and  that  no 
trimming  was  necessary. 

FEW  Controller  Transducers 


Conditions :  Hydraulic  power  ON 
Electrical  power  ON 
Control  Path  la  engaged 

•  Use  FEW  controller  and  position  V4-ACC  module 
in  increments  and  determine  sensitivity  in 
terms  of  volts  per  inch  of  actuator  travel. 
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Figure  11a.  Closed  Loop  Frequency  Response  of  EHSV  la. 
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Figure  11b.  Closed  Loop  Frequency  Response  of  EHSV  lb. 
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TABLE  1.  ELECTROMECHANICAL  TRANSF  CER  ALIGNMENT  DATA 


r 


Results :  Control  transducer  tracking  data  were  re¬ 

corded  from  stop-to-stop  in  five  increments.  The 
readings  for  the  four  FEW  controller  transducers  are 
presented  in  Table  lb.  The  alignment  of  these 
transducers  were  considered  to  be  within  the  control 
range  of  the  auto-tracking  circuitry  and  that  no 
trimming  was  necessary.  The  sensitivity  measured 
and  recorded  to  be  3.07  volts  per  inch  of  actuator 
travel . 

3. 4. 1.4  Auto-Tracking  Loop  Test 

Conditions :  Hydraulic  power  ON 
Electrical  power  ON 
All  control  paths  disengaged 

Note :  The  procedures  in  this  section  differ  to 
some  extent  from  the  Integration  Test  Plan. 

The  changes  in  the  procedures  were  necessary  to 
accommodate  the  added  redundancy  in  the  auto¬ 
tracking  circuitry. 

•  Open  test  SW5  on  EHSV  coil  la  and  null  LVDT  on  EHSV 
with  dc  voltmeter  on  TP3 .  Signal  at  this  point  has 
been  demodulated  and  provides  much  better  null  data 
than  an  ac  voltmeter  reading  across  LVDT  secondary. 

Results :  LVDT  was  nulled  to  0.003  volt. 

•  Short  TP4  to  14  Vdc  in  Control  Path  la  to  isolate 
the  control  input. 

•  Close  SW5  on  EHSV  coil  la.  This  closes  EHSV  loop; 
dc  voltmeter  at  TP3  will  now  indicate  any  stand-off 
voltage.  Null  TP3  by  adjusting  "Pot"  3. 

Results :  Adjusted  TP3  to  zero  volts. 

•  Apply  pulse  to  EHSV  la  loop  by  positioning  SW2  to 
PULSE  and  depressing  SWl.  Qualitatively  observe  the 
results  at  TP3  and  note  stability  characteristics. 


Results :  Transient  response  observed  at  TP3  qualita¬ 
tively indicated  good  loop  stability. 


Repeat  procedure  for  Control  Paths  lb,  2a,  and  2b. 
Results :  Same  as  la. 

•  Remove  short  from  TP4  in  Control  Path  la;  engage 
Control  Path  la;  and  apply  a  pulse  by  positioning 
SW3  to  la,  SW2  to  PULSE,  and  depressing  SWl .  Note 
closed  loop  stability  characteristics. 

Results :  Transient  response  observed  on  actuator  feed¬ 
back  transducer  qualitatively  indicated  good  actuator 
loop  stability. 

•  Remove  all  shorts  from  TP4  to  14  Vdc  and  engage 
other  control  paths;  V4-ACC  system  will  now  track 
the  FEW  control  input. 

•  Drive  the  V4-ACC  system  from  stop-to-stop  with  the 
FEW  controller,  examine  for  interferences  over  the 
complete  range  of  travel. 

Results :  The  actuator  tracked  the  FEW  controller  very 
smoothly  and  no  interference  was  noted. 

•  Drive  actuator  in  increments  over  operating  range 
and  record  voltages  at  TP3  and  TP6.  This  test  is  to 
examine  tracking  characteristics  of  the  auto-track¬ 
ing  circuitry. 

Results ;  Voltmeter  readings  for  TP3  and  TP6  for  five 
actuator  positions  are  shown  in  Table  2 .  Full  EHSV 
displacement  produces  an  output  at  TP3  of  1.30  Vdc.  As 
can  be  appreciated  from  Table  2,  the  EHSVs  tracked  within 
about  ±0.7  percent  in  terms  of  maximum  EHSV  travel  and 
0.028  percent  in  terms  of  total  actuator  travel.  The 
worst  case,  which  occurred  at  95  percent  actuator  travel, 
was  ±2.3  percent  in  terms  of  EHSV  and  0.09  percent  in 
terms  of  actuator  travel;  for  a  travel  of  four  inches, 
this  would  be  equivalent  to  0.0036  inch.  The  tracking 
function  can  be  appreciated  by  noting  the  last  incremen¬ 
tal  change  of  TP3  from  +0.018  to  0.000  and  relating  this 
change  to  the  track  signal  at  TPS  which  had  an  associated 
change  from  -0.048  to  -0.256.  The  auto-track  function  is 
considered  to  be  very  effective  in  reducing  "force- fight" 
between  pistons  as  well  as  flow  disagreements  between 
companion  valves;  e.g.,  EHSVs  la  and  lb. 
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TABLE  2.  AUTO-TRACK  LOOP  DATA 


3.4.2  Operational  Suitability  Test 


3. 4. 2.1  Characteristics  Under  Normal  Conditions 

Conditions ;  Electrical  power  ON 
Hydraulic  power  ON 

All  control  paths  disengaged  (mechanical 
mode ) 

Load  actuator  adjusted  for  typical  static 
load 

•  Measure  displacement  threshold  of  pilot  controls  in 
terms  of  inches  at  top  of  stick.  This  will  actually 
show  up  as  a  "dead  spot"  in  the  controls.  For  this 
to  be  meaningful,  the  measurement  should  be  cor¬ 
rected  to  reflect  the  difference  in  the  short  link¬ 
age  control  ratio  and  control  ratio  in  the  test 
helicopter. 

Results :  The  threshold  measurement  was  accomplished  by 
displacing  control  stick  in  one  direction;  stopping  and 
recording  actuator  position  from  Actuator  Feedback  Trans¬ 
ducer  la  in  volts;  and  the  measuring  the  required  control 
stick  displacement  in  the  other  direction  to  effect  an 
actuator  movement  as  indicated  by  a  change  on  the  feed¬ 
back  transducer. 

The  threshold  at  the  top  of  the  stick  and  corrected  to 
the  proper  control  ratio  was  ±0.06  inch  or  0.6  percent  of 
total  travel. 

•  Measure  the  FEW  input  threshold  in  volts  required 
from  the  simulated  inputs  to  effect  a  displacement 
of  the  V4-ACC  system.  As  in  the  above  case,  this 
measurement  should  be  corrected  to  read  in  terms  of 
percent  of  the  actual  capable  travel  of  the  V4-ACC 
system. 

Results :  The  FEW  input  threshold  was  measured  by  moving 
the  FEW  controller  in  one  direction;  stopping  and  record¬ 
ing  Actuator  Feedback  Transducer  la  position  in  volts  as 
well  as  the  FEW  Control  Transducer  la  in  volts;  moving 
the  FEW  controller  in  the  opposite  direction  until  the 
feedback  transducer  indicated  a  change;  and  then  reading 
the  voltage  change  on  FEW  Control  Transducer  la.  The 
threshold  voltage  corrected  to  read  in  terms  of  the 
actual  capable  travel  of  the  actuator  is  ±0.016  percent 
of  total  travel. 


3. 4. 2. 2  Characteristics  Under  Single-Failure  Conditions 


Conditions :  Same  as  3.4.2. 1,  except  that  Control  Path  2a 

is  disengaged 

Procedures :  Same  as  3. 4. 2.1 

Results ;  0.006  ±  percent  of  total  actuator  travel 

3. 4. 2. 3  Characteristics  Under  Dual-Failure  Conditions 

3. 4. 2. 3.1  Two  Companion  Control  Paths  (sharing  same  piston) 

Conditions :  Same  as  3. 4. 2.1,  except  that  Control  Paths 
2a  and  2b  are  disengaged 

Procedures :  Same  as  3. 4. 2.1 

Results :  0.012  ±  percent  of  total  actuator  travel 

3. 4. 2. 3. 2  Two  Control  Paths  not  Sharing  Same  Piston 

Conditions ;  Same  as  3. 4. 2.1,  except  that  Control  Paths 
lb  and  2b  are  disengaged 

Procedures ;  Same  as  3. 4. 2.1 

Results ;  ±0.009  percent  of  total  actuator  travel 

3. 4. 2. 3. 3  One  Control  Path  and  Associated  Failure  Management 
Circuit 


Conditions ;  Same  as  3. 4. 2.1,  except  that  Control  Path  lb 
is  failed  hard  and  failure  management  cir¬ 
cuit  lb  is  inoperative 

Procedures ;  Same  as  3. 4. 2.1 

Results ;  ±0.006  percent  of  total  actuator  travel 

3. 4. 2. 4  Characteristics  Under  Failure  of  One  Electrical  Sup¬ 
ply 

Conditions ;  Same  as  3. 4. 2.1,  except  that  electrical  sup¬ 
ply  to  Control  Paths  2a  and  2b  is  off 
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Procedures:  Same  as  3. 4. 2.1 


Results :  Loss  of  this  power  supply  disengages  Control 

Paths  2a  and  2b.  Hence,  results  are  same  as  3. 4. 2. 3.1 
and  the  threshold  is  ±0.012  percent  of  total  actuator 
travel . 

3. 4. 2. 5  Characteristics  Under  Complete  Failure  of  Electrical 
and  Hydraulic  Power 

Conditions :  Same  as  3. 4. 2.1,  except  that  all  electrical 

and  hydraulic  power  is  turned  off 

Results:  Loss  of  hydraulic  pressure  allows  the  by-pass 
valves  on  both  pistons  to  go  to  the  "by-pass"  position 
which  allows  freedom  of  motion  as  far  as  the  hydraulics 
are  concerned.  The  combined  friction  of  the  V4-ACC 
system  and  the  load  actuator  requires  about  100  pounds  at 
the  cyclic  grip  to  produce  motion.  This  obviously  is  not 
considered  suitable  for  flight. 

3 . 4 . 2 . 6  FEW  to  Mechanical  Control  Switching  Transients .  The 
purpose  of  this  test  is  to  check  the  transients  induced  into 
the  control  system  when  the  safety  pilot  switches  from  FEW 
control  to  mechanical  control. 

Conditions:  Electrical  power  ON 

Hydraulic  power  ON 

Quad  control  paths  engaged 

Load  actuator  adjusted  for  typical  static 
load 

Connect  voltmeter  to  actuator  position  sig¬ 
nal  for  path  la,  using  +14  Vdc  as  reference 

•  Note  voltmeter  reading  prior  to  FEW  mode  disengage¬ 
ment  and  compare  with  reading  after  disengagement. 
The  difference  in  these  two  measurements  can  be 
attributed  to  the  amount  of  motion  in  the  safety 
pilot's  hydraulic  valve  displacement  translated  into 
an  analog  signal  read  on  the  voltmeter. 


48 


Results :  Test  was  made  with  the  mechanical  valve  against 
the  stops  to  test  for  the  worst  condition.  When  the  FEW 
mode  was  disengaged,  the  motion  of  the  cyclic  grip  when 
corrected  for  the  proper  control  ratio  was  0.15  inch.  If 
flight  test  should  indicate  that  this  transient  is  not 
acceptable,  preloaded  centering  springs  can  be  added  to 
the  mechanical  valve.  The  preload  would  have  to  be  high 
enough  to  drag  the  mechanical  control  along. 

3.4.3  Failure  Modes  and  Effects  Analysis  Test 

The  tests  in  this  section  cover  the  basic  types  of  failures 
that  can  occur.  The  intent  is  to  validate  the  V4-ACC  as  a 
viable  fault- tolerant  actuation  system.  The  FEW  control 
paths,  up  to  and  including  the  EHSVs,  will  be  tested  to  assure 
a  failure  tolerance  level  of  dual  fail-operate  for  the  worst 
conditions . 

The  failure  modes  covered  in  the  subsequent  subsections  will 
be  simulated  using  the  switches  on  the  failure  simulation 
panel;  two  hydraulic  hand  valves;  and  combinations  of  these 
input  devices.  Pertinent  parameters  will  be  measured  and 
recorded  to  define  failure  effects.  The  measurements  will  be 
made  using  an  oscilloscope  and  digital  voltmeter.  Except  as 
noted,  all  initial  conditions  will  be  for  all  control  paths 
and  power  supplies  operating. 

3. 4. 3.1  Control  Paths  and  Failure  Management  System 

3. 4. 3. 1.1  Transient  Disturbances.  The  purpose  of  this  is  to 
show  tolerance  to  EMI  type  disturbances. 

•  Position  SW2  to  PULSE  position  and  use  momentary  SWl 
to  apply  short  pulse  (0.2  second)  to  Control  Path 
la. 


Results ;  Actuator  displaced  0.086  inch  (2.2  percent  of 
total  stroke)  for  about  0.2  second  and  then  returned  to 
original  position  which  confirmed  tolerance  to  a  0.2 
second,  or  less,  hard  transient. 

•  Re-engage  Control  Path  la. 

Adjust  pulse  width  to  about  0.4  second  and  apply 
pulse  to  Control  Path  la. 


Results :  Control  Path  la  displaced  0.086  inch,  disen¬ 
gaged,  and  returned  to  original  position  in  about  0.35 
second. 

3. 4. 3. 1.2  Second  Hard  Failure.  This  test  is  to  demonstrate 
the  ability  of  the  system  to  manage  a  second  failure  and 
continue  operating. 

Simulate  second  failure  in  Control  Path  2a  by  posi¬ 
tioning  SW3  to  2a  and  positioning  SW2  to  HARD. 

Results :  Control  Path  2a  displaced  about  0.088  inch, 
disengaged,  and  returned  to  original  position  in  about 
0.35  second. 

•  Re-engage  Control  Paths  la  and  2a. 

3. 4. 3. 1.3  Single  Inert  Control  Path  Failure.  This  test  is  to 
demonstrate  the  ability  of  the  system  to  manage  inert  type 
failures . 


•  Simulate  inert  failure  by  positioning  SW5  to  OPEN 
which  simulates  an  open  in  EHSV  coil  la. 

Results ;  If  there  is  an  appreciable  load  on  the  actua¬ 
tor,  Control  Path  la  immediately  disengages.  Under  a 
no-load  condition,  however.  Control  Path  la  does  not 
normally  disengage  until  an  appreciable  actuator  dis¬ 
placement  is  commanded.  This  cannot  present  a  problem 
since  it  will  always  disengage  on  demand,  i.e.,  if  addi¬ 
tional  force  is  needed  from  the  actuator,  a  position 
error  signal  is  created  that  disengages  Control  Path  la. 

•  Re-engage  Control  Path  la. 

3. 4. 3. 1.4  Second  EHSV  Coil  Failure.  This  test  is  to  demon¬ 
strate  the  ability  of  the  system  to  manage  two  inert  type 
failures.  If  two  such  failures  are  not  properly  managed,  a 
"two-and-two"  vote  condition  can  occur.  This  system  recog¬ 
nizes  the  condition  and  disengages  both  faulty  control  paths. 

Simulate  two  open  EHSV  coil  failures  by  positioning 
SW5  in  Control  Paths  la  and  lb  to  OPEN 

Results :  For  a  no-load  condition,  a  command  for  0.056 

inch  of  actuator  displacement  was  required  to  disengage 
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■the  two  control  pa'ths.  With  an  appreciable  actuator 
load,  the  control  paths  disengaged  immediately  without  a 
displacement  command. 

•  Close  SW5  on  Control  Paths  la  and  lb. 

•  Re-engage  Control  Paths  la  and  lb. 

3. 4. 3. 1.5  Failure  Management  Circuitry  Failure  Plus  Associ¬ 
ated  Control  Path  Failure.  This  test  is  to  demonstrate  •the 
capability  of  the  system  to  operate  with  one  control  path 
failed  and  not  disengaged,  and  hence  not  isolated,  as  a  result 
of  the  associated  failure  management  unit  having  failed 
"inert. " 


•  Close  SW4,  Control  Pa'th  la,  to  simulate  an  inert 
failure  management  unit. 

•  Position  SW3  to  la  and  SW2  to  HARD  to  simulate  a 
hard  failure  in  Control  Path  la. 

Results :  The  actuator  displaced  0.13  inch  and  continued 
to  operate  normally  wi-th  the  exception  of  the  0.13  inch 
offset.  This  is  a  means  of  demonstrating  that  the  basic 
system  (without  failure  management)  will  inherently 
tolerate  one  failure  and  continue  to  operate. 

•  Measure  and  record  the  stall  load  for  this  condition 
in  terms  of  pressure  on  the  load  actuator. 

Results:  Stall  pressure  was  500  psi. 

•  Open  SW4  which  allows  Failure  Management  Unit  la  to 
become  operative. 

Results :  Control  Path  la  disengaged  as  expected. 
Disengage  Control  Path  lb. 

Measure  and  record  stall  load  for  this  condition  in 
terms  of  pressure  on  the  load  actuator. 

Results :  Stall  load  pressure  was  500  psi,  which  is  the 
same  as  the  above  stall  load  pressure.  This  indicates 
that  if  a  first  failure  is  a  failure  management  unit  and 
the  second  failure  is  the  associated  control  path,  the 
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effect  of  the  EHSV  in  the  faulty  control  path  is  essen¬ 
tially  cancelled  by  the  comparison  valve;  i.e.,  the 
companion  EHSV  effects  a  hydraulic  "short"  circuit  that 
results  in  zero  pressure  across  the  associated  piston. 

3. 4. 3. 1.6  Failure  Management  Circuitry  Shorted  to  Ground. 

This  failure  was  considered  to  be  the  worst  case  failure  prior 
to  some  improvements  that  were  incorporated  into  the  failure 
management  circuitry.  With  the  improved  circuitry,  this 
failure  mode  was  deleted.  The  failure  mode  discussed  above  in 
3. 4. 3. 1.5  is  now  considered  the  worst  case  failure,  which  as 
discussed,  presents  no  problem. 

3. 4. 3. 2  Reversion  to  Mechanical  Control.  The  objective  of 
this  test  is  to  demonstrate  the  capability  of  the  actuation 
system  to  automatically  switch  to  mechanical  backup  control  if 
all  FEW  control  paths  should  experience  failures  and  subse¬ 
quent  disengagements. 

•  Insert  failure  in  Control  Paths  la,  2a,  and  2b. 

•  System  should  automatically  revert  to  mechanical 
backup.  Measure  and  record  transit. 

Result:  The  third  failure  insert  does  not  necessarily 
mean  that  both  of  the  remaining  control  paths  disengage. 
However,  when  all  four  control  paths  are  disengaged,  the 
system  automatically  reverts  to  mechanical  control .  A 
short  actuator  jump  was  experienced  which  was  measured  in 
terms  of  top  of  the  cyclic  and  grip  and  correct  for 
proper  control  motion  ratio.  The  corrected  value  of  the 
reversion  jump  was  0.127  inch  or  1.27  percent  of  total 
travel . 

3. 4. 3. 3  Electrical  Power  Supply.  Three  or  more  electrical 
supplies  would  normally  be  used  for  flight  test  hardware.  For 
the  laboratory  test,  however,  only  two  sources  are  simulated. 
The  objective  of  this  test  is  to  demonstrate  that  after  a 
failure  of  electrical  power  to  two  related  control  paths 
(e.g.,  la,  lb),  the  actuation  system  continues  to  operate. 

And,  after  the  loss  of  electrical  power  to  the  other  two 
controls  paths  (total  loss  of  electrical  power),  the  hybrid 
actuation  system  automatically  reverts  to  manual  backup  con¬ 
trol  . 
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3. 4. 3. 3.1  Single  Failure.  Power  Supply  No.  1  provides  power 
to  Control  Paths  la  and  lb  while  Supply  No.  2  provides  elec¬ 
trical  power  to  Control  Paths  2a  and  2b.  The  existing  power 
switches  on  the  Engage/Disengage  Panel  will  be  used  to  simu¬ 
late  Electrical  Power  Supplies  Nos.  1  and  2. 

Position  power  switches  for  Control  Paths  la  and  lb 
to  OFF. 

Result:  The  engage/disengage  relays  for  Control  Paths  la 
and  lb  operate  from  Electrical  Supply  No.  1  and,  hence, 
the  two  control  paths  disengaged.  Control  Paths  2a  and 
2b  continued  to  operate  in  a  normal  manner. 

3. 4. 3. 3. 2  Dual  Failure.  The  purpose  of  this  test  is  to 
demonstrate  that  if  both  electrical  supplies  fail,  the  hybrid 
actuator  will  automatically  provide  the  pilot  with  the  backup 
mechanical  input. 

•  Position  power  switches  for  all  control  paths  to 
OFF. 

Results  I  Control  Paths  2a  and  2b  disengaged  which,  in 
turn,  automatically  effected  a  reversion  to  mechanical 
controls  since  Control  Paths  la  and  lb  had  been  previ¬ 
ously  disengaged. 

3. 4. 3. 4  Hydraulic  Power  Supply.  Three  or  more  hydraulic  sup¬ 
plies  would  normally  be  used  for  flight  test  hardware.  For 
the  laboratory  test,  however,  only  two  sources  are  simulated. 
The  objective  is  to  demonstrate  that  after  the  hydraulic  power 
to  one  piston  is  lost,  the  actuation  system  will  continue  to 
operate,  and  that  after  the  loss  of  hydraulic  power  to  the 
other  piston  (total  loss  of  hydraulic  power),  the  actuation 
system  reverts  to  pure  mechanical  non-boosted  controls. 

3. 4. 3. 4.1  Single  Failure 

•  Cut  off  Hydraulic  Supply  No.  1. 

Results :  Loss  of  pressure  for  Piston  No.  1  relieves 
force  on  by-pass  valve  as  well  as  the  two  isolation 
valves  for  Control  Paths  la  and  lb.  Control  Paths  2a  and 
2b  continue  working  with  Piston  No.  2  in  a  normal  manner. 
Failure  of  hydraulic  pressure  to  Control  Paths  la  and  lb 
and,  hence,  Piston  No.  1,  creates  the  same  failure  mode 
as  if  the  two  control  paths  had  failed  and  disengaged 
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with  one  exception.  The  exception  is  that  if  hydraulics 
should  come  back  on,  the  two  control  paths  would  be 
operable  again  since  the  electronics  remain  engaged.  A 
backup  hydraulic  supply,  of  course,  would  be  used  in  a 
flyable  system  and  would  take  over  in  the  event  one  of 
the  primary  supplies  failed. 

3. 4. 3. 4. 2  Dual  Failure 

•  Cut  off  Hydraulic  Supply  No.  2. 

Results :  Loss  of  Supply  No.  2  affects  Control  Paths  2a 

and  2b  in  the  manner  as  described  above  relative  to 
Control  Paths  la  and  lb.  Both  by-pass  valves  across  the 
two  pistons  are  open  as  a  result  of  the  loss  of  both 
hydraulic  systems;  however,  the  mechanical,  unboosted 
controls  require  too  much  force  to  overcome  the  friction 
of  the  V4-ACC  system  plus  the  load  actuator  to  be  consid¬ 
ered  as  operable.  As  stated  above,  a  backup  hydraulic 
supply  would  be  used  to  effect  a  dual  fail-operate  hy¬ 
draulic  system  for  a  flyable  system. 

3 . 4 . 3 . 5  Summary  Discussion  on  Failure  Mode  Testing .  The 
V4-ACC  with  mechanical  reversion  performed  the  failure  manage¬ 
ment  function  in  a  very  positive  manner  for  all  failure  modes. 
Due  to  the  inherent  characteristics  of  the  basic  concept,  the 
failure  management  does  not  have  to  effect  an  instant  disen¬ 
gagement  of  a  failed  control  path.  Hence,  it  can  afford  a 
time  delay  to  confirm  the  presence  and  continued  existence  of 
a  failure  as  well  as  require  a  comparatively  high  fail-signal 
for  a  more  positive  failure  identification. 

The  failure  modes  covered  in  the  test  program  represents  major 
type  failures.  An  informal  BHT- funded  failure  analysis  on  the 
electronic  control  and  failure  management  circuitry  was  con¬ 
ducted  apart  from  this  program  which  covered  detail  failures 
such  as:  shorted  op-amp  inputs,  voltage  breakdown  of  FET 
switches,  open  limiting  diodes  in  the  auto-tracking  circuitry, 
14  Vdc  supply,  4  KHz  electrical  supply,  etc.  None  of  the 
failures  presented  a  failed  condition  that  was  different  from 
the  simulated  failures  covered  in  the  preceding  subsection. 
Also,  none  of  the  failures  were  of  the  type  that  propagated 
other  failures. 


54 


The  BHT  program  also  covered  auto-preflight  requirements  that 
were  considered  necessary  to  locate  inert  type  failures  in  the 
failure  management  circuitry.  It  was  concluded  that  only  four 
test  points  per  control  path  would  be  needed  to  assure  that 
these  circuits  were  operable.  With  the  failure  management 
units  in  an  operable  state,  failure  protection  is  assured  and 
the  control  paths  can  be  safely  engaged. 


4 .  RECOMMENDAT I ON 


The  feasibility  of  the  V4-ACC  was  determined  on  a  Bell  Heli¬ 
copter  IR&D  program.  Under  Contract  No.  NAS2-10289  Mod  1  with 
NASA/Ames,  the  actuation  concept  was  confirmed  as  a  valid 
candidate  for  use  in  a  FBW  control  system  for  the  XV-15  tilt 
rotor  aircraft.  Under  Contract  No.  N62269-79-C-0292  with  the 
Naval  Air  Development  Center,  the  concept  was  confirmed  as  a 
candidate  for  use  as  a  fault-tolerant  actuation  system  for  a 
potential  helicopter  test  vehicle.  The  extensive  laboratory 
testing  under  this  contract  further  confirms  the  results  from 
the  preceding  programs  and  specifically  confirms  its  applica¬ 
tion  with  mechanical  reversion  for  use  in  automatic  shipboard 
landing  systems.  To  obtain  the  best  return  from  the  foregoing 
technological  investments,  a  follow-up  program  is  needed  to 
develop  flightworthy  hardware  and  proceed  with  a  flight  test 
validation  program.  A  recommended  program  is  discussed  below. 

The  most  profitable  approach  to  such  a  program  is  to  take 
necessary  steps  to  make  the  existing  laboratory  equipment 
flightworthy  and  to  install  and  flight  test  this  equipment  in 
the  collective  channel  of  a  helicopter,  preferably  an  AH-IS 
Cobra.  The  Cobra  collective  channel  is  equipped  with  two 
primary  hydraulic  pumps  and  a  third  electrically  driven  pump 
that  can  be  used  to  effect  a  dual  fail-operate  system.  Redun¬ 
dant  electrical  power  can  be  provided  by  adding  another 
starter/generator  to  the  transmission  and  two  dedicated  bat¬ 
teries  connected  to  the  generators  through  charging  circuits. 
The  collective  stick  in  the  gunner  station  (front  seat)  can  be 
mechanically  disconnected  from  the  pilot's  controls  and  used 
as  the  FBW  controller.  The  pilot's  collective  controls  would 
then  be  used  for  the  mechanical  back-up  mode. 

The  plan  is  to  reconfigure  the  existing  equipment  into  flight¬ 
worthy  equipment  by: 

Separating  the  FBW  hydraulic  module  (see  Figure  4)  from 
the  actuator  and  mount  it  to  the  structure  in  a  close-by 
location. 

•  Building  a  new  mechanical  control  head  (see  Figure  4) 
that  is  much  smaller  and  flightworthy. 

Adapting  the  existing  mechanical  input  linkage  for  com¬ 
patibility  with  the  new  mechanical  control  head. 
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Connecting  tne  FBW  hydraulic  module  to  the  mechanical 
control  head  with  "flex-lines." 

Repackaging  the  existing  circuit  boards  (see  Figure  3) 
into  an  ECU  that  is  more  suitable  for  flight  test. 

Designing  and  fabricating  a  control  panel  with  provisions 
for  preflight  test. 

The  program  will  include  the  necessary  analysis  and  test  to 
assure  that  the  above  equipment  configurations  are  flight¬ 
worthy.  Adequate  equipment  and  installation  drawings  as  well 
as  documentation  of  tests  and  analysis  will  be  provided  to 
satisfy  the  safety  of  flight  release.  The  flight  test  program 
will  include  ground  run,  operational  suitability  test,  and 
in-flight  failure  mode  effects  tests. 


The  recommended  program  should  result  in  a  flight-validated 
actuation  concept  and  should  also  provide  the  necessary  tech¬ 
nology  to  develop  a  multi-axis  prototype  control  system. 


APPENDIX  A 


TECHNICAL  DISCUSSION  OF  A  V4-ACC 


INTRODUCTORY  COMMENTS 

This  section  describes  the  basic  V4-ACC  as  it  relates  to  the 
basic  control  elements.  It  provides  a  conceptual  description 
of  the  electrical  links,  electrohydraulic  interface,  power 
actuators,  and  failure  management  system.  The  actuator  con¬ 
figuration  may  be  a  redundant  tandem  piston,  a  parallel  actua¬ 
tor  configuration,  or  a  redundant  rotary  actuator.  The  FEW 
module  can  be  an  integral  part  of  the  hydraulic  cylinder  or 
the  FEW  module  can  replace  the  mechanical  control  head  as 
shown  in  Figure  Al.  To  facilitate  the  description  of  the 
concept  in  the  subsequent  subsections,  a  conventional  dual 
tandem  piston  configuration  will  be  used  (see  Figures  Al  and 
A2)  . 

To  provide  a  viable  fault-tolerant  control  system,  it  is 
necessary  to  have  an  adequate  number  of  reliable  control  paths 
and  actuators  for  each  control  channel  and,  also,  a  compati¬ 
ble,  secure  failure  management  system.  The  system  described 
in  the  following  material  satisfies  the  control  channel  re¬ 
quirement  and  includes  a  unique  concept  for  sensing  and  iso¬ 
lating  a  failed  and/or  degraded  control,  path. 

DESCRIPTION  OF  CONCEPT 


Summary 

The  basic  fault-tolerant  actuation  system  consists  of  dual  hy¬ 
draulic  primary  actuators,  quadruplex  electrical  control 
paths,  a  failure  management  system,  and  electrical  drive 
signals.  Two  electrical  control  paths  are  used  for  each 
piston.  The  failure  management  system  is  mechanically  inter¬ 
faced  with  the  electrical  control  paths  to  provide  maximum 
security.  It  provides  automatic  disengagement  of  a  control 
path  and  also  provides  track  error  signals  that  are  used  in 
the  control  paths  for  automatic  alignment  of  the  four  valves. 

A  flight  test  model  of  this  system  would  include  a  master 
control  panel  and  an  annunciator  panel.  The  control  panel 
would  provide  the  necessary  control  functions,  preflight 
checkout  capability,  and  a  manual  reset  for  each  control 
channel.  The  annunciator  panel  would  indicate  the  operating 
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condition  of  the  control  paths  and  would  operate  in  conjunc¬ 
tion  with  the  control  panel  for  the  preflight  checkout. 

FEW  Control  Paths 


A  control  axis  of  the  basic  V4-ACC  consists  of  four  FEW  con¬ 
trol  paths  and  a  dual  piston  power  cylinder.  The  four  control 
paths  connect  the  pilot's  control  input  to  the  power  actuator 
cylinder  and  include  the  four  electrohydraulic  servovalves  as 
shown  in  Figure  A2 . 

The  dual  actuator  schematically  depicted  is  conventional, 
except  that  the  control  head  (spool  valve  assembly)  has  been 
replaced  with  the  four  electrohydraulic  servovalves . 

Figure  A2  is  a  functional  schematic  of  the  follow-up  system; 
i.e.,  the  dual  boost  actuator  is  slaved  to  the  pilot's  control 
inputs.  All  control  paths  are  identical  and  operate  simul¬ 
taneously.  A  control  input  to  the  amplifiers  proportionally 
opens  the  valves  and  drives  the  actuator  until  the  dual  feed¬ 
back  transducers  provide  feedback  signals  that  cancel  the 
command  signals  at  the  amplifier,  which  closes  the  valves  and 
hence  stops  the  actuator  at  a  new  position.  The  four  valves 
are  continuously  and  automatically  aligned  by  a  limited  au¬ 
thority  si^al  that  is  inherent  in  the  failure  management 
system  (this  feature  is  discussed  in  more  detail  later).  The 
dual  feedback  transducers  can  be  single  elements  and  separ¬ 
ately  located  to  reduce  vulnerability  to  battle  damage  if 
desired.  The  response  of  the  actuator  can  be  shaped  to  im¬ 
prove  handling  qualities  as  required. 

The  failure  logic  for  the  system  shown  in  Figure  A2  operates 
in  the  following  manner.  If  a  control  path  fails  (e.g.,  path 
la),  the  path  is  automatically  disengaged  and  Valve  la  is  cut 
off  to  prevent  leakage  of  fluid  from  one  side  of  the  piston  to 
the  other.  A  second  path  failure  will  be  disengaged  in  the 
Seune  manner.  If  the  second  failure  should  be  path  lb,  the 
logic  circuitry  will  automatically  engage  a  pressure-operated 
hydraulic  bypass  across  the  common  piston  so  that  the  failure 
will  not  restrict  the  operation  of  the  other  piston.  It  is 
pointed  out  that  if  a  first  failure  should  disable  the  failure 
management  system  (described  in  the  next  section),  the  control 
path  system,  shown  in  Figure  A2,  has  the  inherent  capability 
of  cd3sorbing  a  second  failure.  This  is  possible  because,  for 
example,  if  Valve  la  should  fail  and  remain  hardover,  the 
other  three  valves  will  go  in  the  opposite  direction  to  oppose 
the  actuator  motion.  This  will  effect  a  bypass  around  the 
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piston  common  to  Valves  la  and  lb  and,  hence,  will  allow  the 
other  piston  to  operate  without  any  appreciable  degradation. 
This  inherent  feature  appreciably  improves  the  overall  relia¬ 
bility  of  the  system  and  allows  a  comparatively  simple  failure 
management  system  to  be  used  in  place  of  a  conventional  voting 
scheme.  The  overall  actuation  system  can  be  characterized  as 
a  forgiving  type  system. 

Failure  Management  System 

The  failure  management  system  complements  the  control  paths  to 
provide  a  control  system  with  a  failure  tolerance  level  of 
dual  fail-operate.  It  also  includes  an  inherent  signal  in 
each  control  path  that  is  used  to  effect  a  limited  authority, 
automatic  alignment  function  for  the  control  paths  which 
compensates  for  differences  in  component  tolerance  build-up. 
The  failure  management  system  consists  of  a  failure  sensing 
function  and  an  automatic  detection/disengage  function.  These 
functions  are  conceptually  described  in  the  following  para¬ 
graphs  . 

Failure  Sensing.  The  addition  of  an  LVDT-type  position  trans¬ 
ducer  to  the  porting  stage  of  the  servovalves  (second  stage  on 
conventional  servovalves)  allows  the  failure  management  cir¬ 
cuitry  to  be  mechanically  interfaced  with  the  control  paths. 
This  feature  affords  a  more  secure  means  of  sensing  a  failed 
or  degraded  control  path  without  reducing  the  reliability  of 
the  control  path,  and,  hence,  the  transducer  can  be  used  to 
cover  failures  up  to  the  power  piston.  Several  other  ways  to 
provide  a  valve  feedback  signal  for  this  failure  monitor 
concept  were  considered.  For  example,  differential  pressure 
across  the  second  stage  of  a  conventional  servovalve  can  be 
used.  Also,  the  current  flow  through  the  first  stage  (flapper 
valve  coil)  can  be  used  and  is  more  economical.  However, 
neither  of  these  approaches  will  provide  100  percent  failure 
coverage  and  were  discarded  in  favor  of  the  valve  position 
transducer  approach.  Valves  of  this  type  are  currently  avail¬ 
able. 

The  basic  failure  sensing  function  for  each  power  actuator 
channel  is  provided  simply  by  using  four  equal  value  resistors 
in  conjunction  with  the  4-valve  position  transducers.  Connec¬ 
tion  of  the  resistors  as  shown  in  Figure  A3  constitutes  a  very 
simple  and  reliable  voting  concept  that  allows  each  control 
path  to  comparatively  monitor  itself,  determine  a  failure,  and 
disengage  itself. 


Figure  A3  is  a  simplified  schematic  of  the  basic  concept  for 
sensing  a  failure.  For  normal  operation,  the  voltage  across 
the  valve  position  transducers  should  be  the  same.  Since  the 
voltages  across  the  transducers  are  the  same  regardless  of 
valve  position,  there  will  be  no  appreciable  current  in  the 
resistors.  Current  will  flow  only  in  the  resistors  when  the 
valve  positions  are  not  in  agreement.  If  one  control  path  has 
a  "hard"  failure,  the  respective  porting  stage  will  fully 
displace  while  the  others  will  partially  displace  in  the 
opposite  direction.  The  voltage  differences  will  cause  a 
current  in  the  resistor  associated  with  the  failed  control 
path  that  is  several  times  higher  than  the  current  in  the 
other  resistors,  thus  providing  a  means  for  identifying  the 
failed  path.  For  example,  if  Valve  2b  is  hardover,  the  other 
three  will  be  displaced  a  small  amount  (depending  on  the 
actuator  load)  in  the  opposite  direction  and  each  will  produce 
a  transducer  output  voltage.  The  equivalent  circuit  would  be 
as  shown  in  Figure  A3 . 


As  indicated  in  the  equivalent  circuit,  the  voltage  from  the 
valve  transducer  in  the  failed  control  path  is  opposite  in 
polarity  from  the  other  three  transducers  and,  in  effect,  is 
in  series  and  will  be  additive. 
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The  current  in  each  of  the  other  three  resistors  would  be 

1  (''-''2b) 

4  R 

or  1/3  the  current  in  R2jj*  A  second  failure  would  produce  the 

following  current  condition  (assuming  the  second  failure  is  in 
path  and  the  switch,  S^j^/  has  opened): 

,  _  ("-"lb)  .  2  ("-"lb) 

^Lb  R/3+R  "3  R 


("-"lb) 

The  current  in  the  other  two  resistors  would  be  1/3  - ^ -  or 

one-half  the  current  in  the  resistor  of  the  failed  path. 

In  both  cases,  the  failure  current  associated  with  the  failed 
path  is  high  enough  (compared  to  the  other  currents)  to  pro¬ 
vide  a  means  of  positive  identification  of  a  failure  or  de¬ 
graded  condition. 

The  quad-resistor  network  can  be  looked  upon  as  an  element 
that  interfaces  the  failure  intelligence  of  the  four  control 
paths.  One  common  quad-resistor  network  can  be  used  to  accom¬ 
modate  the  failure  management  units  for  the  four  control  paths 
or  one  can  be  used  for  each  of  the  control  paths  to  provide 
additional  redundancy;  the  trade-off  is  additional  redundancy 
and  failure  isolation  for  additional  cross  coupling.  The 
individual  resistor  network  for  each  control  path  was  selected 
because  of  the  addition  redundancy  and  the  improved  isolation 
of  failure  modes. 

Automatic  Detection/Disengage .  This  function  is  the  part  of 
the  failure  management  system  that  detects  the  occurrence  of  a 
failure  and  isolates  the  fault  by  disengaging  the  affected 
control  path.  If  the  fault  is  not  of  sufficient  magnitude  to 
warrant  a  disengagement,  it  is  presented  to  the  pilot  as  a 
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soft-fail  (e.g.,  high  null)  indication.  The  soft-fail  feature 
is  a  cautionary  device  for  the  pilot  and  constitutes  a  BITE 
function. 


Several  approaches  for  detecting  failures  were  considered. 

One  approach  was  to  simply  compare  the  magnitude  of  the  fail¬ 
ure  voltage  across  each  sense  resistor  ^Ib'  ^2a' 

with  a  set  threshold.  The  second  approach  used  a  scheme  for 
comparing  the  four  failure  voltages  to  determine  a  failure. 
This  approach  is  not  as  simple  as  the  first  approach,  but  it 
appeared  to  be  more  tolerant  to  failures  and  was  successfully 
used  in  the  BHT  V4-ACC  feasibility  program.  Subsequent  stud¬ 
ies,  however,  indicate  that  an  improved  arrangement  of  the 
first  approach  has  some  advantages  and,  as  stated  above,  was 
selected  as  the  preferred  approach.  The  major  advantage  of 
the  first  approach  is  that  it  has  less  failure  modes  and  has  a 
high  degree  of  operational  independence.  The  selected  failure 
detection  technique  affords  a  failure/management  system  that 
is  very  simple  when  compared  to  the  more  conventional  voting 
schemes.  This  failure  detection  scheme  and  the  associated 
automatic  disengage  function  is  shown  in  Figure  A4  and  dis¬ 
cussed  below. 


Figure  A4  is  a  simplified  block  diagram  of  the  failure  manage¬ 
ment  unit  for  Control  Path  2b  and  the  quad-resistor  configura¬ 
tion  which  provides  an  interface  with  the  failure  detection 
systems  for  the  other  control  paths.  All  four  control  paths 
are  identical  to  Control  Path  2b.  The  three  resistors  and 
associated  FET  switches  designated  as  "Outgoing  Vote  Signals" 
are  an  integral  part  of  Control  Path  2b  Electronic  Unit. 

These  signals  are  connected  as  designated  to  the  other  elec¬ 
tronic  units  to  communicate  the  second  stage  position  of  EHSV 
2b.  Hence,  each  control  path  provides  a  status  "vote"  to  the 
failure  of  management  system  of  the  other  control  paths. 

These  signals  are  used  in  the  electronic  units  of  each  control 
path  for  auto-track  of  the  EHSV's  and  for  detecting  a  failure 
condition.  . 

The  signal  symbol  depicted  in  Figure  A4  as  EHSV  POSN  XDUCER  is 
the  secondary  winding  of  the  LVDT  that  senses  the  position  of 
the  second  stage  of  the  EHSV.  The  EHSV  position  transducer 
for  a  control  path  is  excited  with  a  dedicated  4KC  oscillator. 
Since  each  of  these  oscillators  will  have  some  difference  in 
frequency  and,  hence  cannot  be  mixed  directly  as  shown  in  the 
fault  detection  schematic  (Figure  A3),  it  is  necessary  to 
demodulate  the  outputs  so  that  dc  mixing  can  be  used.  As 
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shown,  the  failure  signal  for  Control  Path  2b  is  sensed  across 
resistor  R2^  and  applied  to  a  differential  amplifier.  The 

amplifier  outputs  a  signal  for  two  functions.  It  provides  an 
auto-track  signal  which  is  limited  and  applied  to  the  actuator 
drive  amplifier  for  Control  Path  2b  (see  Figure  A2 ) .  The 
other  signal  is  applied  to  a  double  ended  threshold  circuit 
that  outputs  a  hard  positive  signal  if  the  failure  signal 
exceeds  the  set  threshold.  The  hard  signal  operates  on  the 
time  delay  circuit  which  effects  an  autodisengage  after  a  set 
time  delay.  This  action  disengages  the  electrohydraulic 
solenoid  valve  for  the  Control  Path  2b  and  also  isolates  the 
failure  logic  by  opening  the  FET  switches  in  the  "Outgoing 
Vote  Signals"  as  shown  in  Figure  A4. 

As  an  adjunct  to  the  above  described  failure  detection  con¬ 
cept,  an  additional  feature  was  incorporated  in  the  design  of 
the  failure-sensing  circuitry  that  affords  it  the  intelligence 
to  differentiate  between  the  inert-type  failure  and  a  hard- 
signal  failure.  This  feature  was  tested  in  the  BHT  FBW  lab¬ 
oratory  model  and  proved  to  be  an  asset  to  the  concept.  The 
EHSV  drive  circuitry  has  been  designed  so  that  any  open  cir¬ 
cuit  up  to  the  valve  coil  would  create  a  hard  failure.  Hence, 
the  most  probable  cause  of  an  inert  failure  in  a  control  path 
would  be  an  "open"  or  "short"  in  the  EHSV  coil. 

During  a  cruise  condition,  and  especially  in  calm  air,  the 
EHSV's  displadements  are  comparatively  small.  Hence,  if  one 
path  becomes  inert,  the  disagreement  between  the  inert  control 
path  and  the  operating  paths  may  not  be  of  sufficient  magni¬ 
tude  to  overcome  the  set  threshold  and  effect  a  disengagement. 
This  suggests  that  a  failed  EHSV  coil  failure  could  exist  for 
some  time  without  disengaging  the  respective  channel.  Hence, 
a  simple  circuit  was  included  as  a  part  of  the  failure  manage¬ 
ment  system  to  monitor  the  EHSV  coil  (see  Figure  A5 ) .  It 
simply  relates  the  EHSV  coil  current  with  input  signal  to 
determine  an  open  EHSV  coil  and,  in  turn,  disengages  the 
respective  control  path. 

The  driver  signal  is  amplified  and  is  processed  through  two 
paths  to  the  Monitor  Amplifier.  For  normal  operation  the  gain 
of  the  two  paths  are  equal  and,  hence,  the  output  of  the 
monitor  amplifier  is  essentially  zero.  An  appreciable  differ¬ 
ence  in  the  gain  of  the  two  paths  will  produce  an  output  from 
the  Monitor  Amplifier  when  a  driver  signal  is  present.  If 
this  output  signal  exceeds  the  set  threshold  (e.g.,  4  VDC), 
the  threshold  amplifier  will  output  a  hard  signal  that  will 
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Figure  A5.  Open/Short  EHSV  Coil  Monitor. 
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operate  through  a  time  constant  to  provide  a  disengage  signal. 
For  example,  the  coil  has  a  dc  impedance  of  2000  ohms  and  if 
it  opens,  the  gain  of  the  path  going  to  the  noninverting  stage 
of  the  Monitor  Amplifier  is  very  high  gain  compared  to  the 
other  path  and  will  effect  a  disengagement  when  there  is 
adequate  driver  signal.  On  the  other  hand,  if  the  coil  is 
shorted,  the  other  path  has  a  higher  gain  (by  a  factor  of  3) 
and  will  effect  a  disengagement  when  there  is  an  adequate 
driver  signal.  Obviously,  for  the  latter  condition  it  will 
require  a  much  larger  signal  to  effect  a  disengagement;  for 
the  gains  as  shown,  it  would  require  a  driver  signal  of  .6 
volts.  This  does  not  present  a  problem,  however,  since  it 
will  produce  a  disengagement  on  demand. 


SUMMARY  COMMENTS:  V4-ACC 

Is  a  comparatively  simple-low  parts  count  system 
Is  a  forgiving  type  system 
Requires  only  one  monitoring  plane 
Installation  requires  no  special  provisions 
Is  easily  retrofitted 

Flexible  -  has  application  to  any  rotating  controls 
configuration  as  well  as  conventional  control  surfaces 

Affords  the  capability  of  leaving  mechanical  controls  in 
copilot  station  during  the  development  period 
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1.  SCOPE 


The  intent  of  the  integrated  systems  test  is  to  validate  the 
operation  of  the  4-valve  fly-by-wire/mechanical  actuator 
concept  as  a  viable  actuation  concept  for  the  Autoland  Test 
Vehicle.  The  laboratory  model  of  the  actuator  as  tested  per 
this  document  is  functionally  the  same  as  a  flight  model,  but 
to  reduce  cost,  the  physical  configuration  is  different.  A 
flight  model  will  be  much  more  compact.  The  circuit  configura¬ 
tion  of  the  failure/management  and  actuator  drive  circuitry  is 
suitable  for  subsequent  use  in  a  flight  test  model. 

This  system  is  a  full  authority  FEW  system  that  may  be  over¬ 
ridden  by  the  safety  pilot's  mechanical  system.  A  "kill"  or 
override  function  is  provided  on  the  safety  pilots  mechanical 
control  to  completely  isolate  the  fly-by-wire  system.  This 
override  function  is  provided  as  a  third  level  failure  con¬ 
sideration. 

The  following  sections  describe  the  subject  equipment,  test 
stand,  auxiliary  equipment,  procedures  for  integrating  the 
equipment,  and  means  for  determining  operational  suitability, 
failure  mode  testing,  and  failure  effects. 


2.  DESCRIPTION  OF  HARDWARE 


2.1  GENERAL  DESCRIPTION 

The  test  system  consists  of  a  hybrid  4-valve  fly-by-wire/mech¬ 
anical  actuator  assembly,  load  actuator,  control  circuitry  for 
both  actuators,  and  a  control/failure  simulation  panel.  These 
equipments  are  installed  on  a  laboratory  test  stand  having 
hydraulic  and  electrical  supplies  that  are  configured  to 
simulate  dual  supplies.  Either  hydraulic  supply  will  operate 
the  4-valve  actuator  through  a  pressure-operated  selector 
valve.  The  fly-by-wire  actuator  is  equipped  with  a  mechanical 
input  that  can  be  activated  by  a  control-stick-mounted  switch. 
Figures  1  through  4  describe  the  test  system. 

2.2  HYBRID  FLY-BY-WIRE/MECHANICAL 

The  basic  actuator  is  equipped  with  a  fly-by-wire  electro- 
hydraulic  module,  and  a  mechanical  control  valve.  The  actua¬ 
tor  can  be  controlled  electrically  or  mechanically.  In  either 
case,  the  pilot  control  stick  moves  when  the  actuator  moves. 

The  pilot's  control  stick  is  equipped  with  a  switch  that  acti¬ 
vates  a  hydraulic  solenoid  in  the  mechanical  isolating  valve 
to  disengage  the  4-valve  fly-by-wire  control.  Existing  4-valve 
fly-by-wire  actuator  hardware  has  been  used  when  feasible  to 
reduce  cost.  The  resultant  hybrid  actuator  is  functionally 
the  same  as  a  flight  test  model  but  the  physical  configuration 
is  different.  It  primarily  differs  in  that  the  fly-by-wire 
module  is  hydraulically  connected  to  the  cylinder  through  the 
isolation  stage  in  the  mechanical  control  head.  This  approach 
was  used  in  place  of  developing  a  new  actuator  barrel  with 
fly-by-wire  module  integrally  connected.  Figure  1  is  a  sche¬ 
matic  of  the  laboratory  configuration.  A  flight  test  module 
with  the  fly-by-wire  module  fabricated  as  an  integral  part  of 
the  barrel  will  be  much  more  compact. 

Existing  hardware  has  been  used  in  the  test  stand  where  prac¬ 
tical.  The  actuator  has  four  inches  travel  and  is  compatible 
with  the  pilot's  controller  for  full  travel. 

2.3  LOAD  ACTUATOR  AND  CONTROL  CIRCUITRY 

The  load  actuator  is  shown  schematically  in  Figure  1  and  can 
be  identified  in  Figure  2  as  the  actuator  connected  to  the  end 
of  the  pivoted  beam.  As  shown,  it  is  connected  so  that  it  can 
be  used  for  simulating  reactionary  loads  from  the  output 
control  elements.  The  load  actuator  is  controlled  by  appropri¬ 
ate  circuitry  in  a  closed-loop  configuration.  Reactionary 
loads  are  simulated  by  adjusting  the  hydraulic  pressure  and 
electrically  driving  the  acuator  with  a  signal  generator. 
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Figure  2.  Plan  Layout  of  Equipment  -  Test  Stand. 


2.4  FAILURE  MANAGEMENT  AND  ELECTRONIC  CONTROL  CIRCUITRY 


Figure  3  is  a  schematic  of  the  failure  management  and  elec¬ 
tronic  control  circuitry  as  well  as  the  test  circuitry  for 
simulating  failures.  The  hand  controller  simulates  test  pilot 
inputs  and  is  mechanized  with  four  parallel  potentiometers. 
AFCS  signals  can  be  accommodated  through  an  auxiliary  input. 

A  photograph  of  the  electronic  circuitry  is  shown  in  Figure  4. 
Each  circuit  board  includes  the  failure  management  circuitry, 
control  circuitry,  and  failure  simulation  circuitry  for  one 
control  path. 

2.5  CONTROL/ANNUNCIATOR  PANEL 

The  control/annunciator  panel  is  shown  in  Figure  4  as  an 
integral  part  of  the  housing  for  the  electronic  circuitry.  It 
provides  the  capability  of  engaging/disengaging  individual 
control  paths,  annunciation  states  of  each  control  path,  and 
simulating  the  following  failure  mode  for  each  control  path. 

Transient  input  (pulse) 

•  Hard  control  path  failure 
Open  EHSV  coil 

Inert  failure  of  failure  management  circuitry. 
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3.  INTEGRATION  TEST  OF  EQUIPMENT 


3 . 1  FUNCTIONAL  TEST 

3.1.1  Hybrid  Actuator-Mechanical  Control 

With  hydraulics  on  and  fly-by-wire  module  disengaged,  move 
pilot's  controls  from  stop  to  stop  and  quantitatively  check 
for  operational  suitability.  Note  dead  spots,  thresholds, 
breakout  forces,  etc.  Turn  off  Supply  No.  1;  Supply  No.  2 
should  automatically  take  over.  Apply  pressure  to  load  actua¬ 
tor,  and  with  an  appreciable  amount  of  load,  move  actuator 
from  stop -to -stop  to  assure  proper  operation. 

3.1.2  Hybrid  Actuator  Fly-by  Wire  Control 

The  loop  gains  and  compensation  networks  were  used  on  the 
NAVTOLAND  Program  and  therefore  it  is  assumed  that  all  the 
closed  loops  are  stable.  The  control  paths,  however,  will  be 
realigned  to  assure  proper  operation.  Each  control  path  will 
be  aligned  and  tested  separately  under  the  conditions  stated 
below.  Reference  should  be  made  to  Figure  3  for  supplemental 
information.  It  is  pointed  out  that  the  operational  amplifiers 
are  operated  from  +28  Vdc  to  ground  with  +14  Vdc  used  as 
common. 

3. 1.2.1  Alignment  and  Test  of  Control  Paths 
4  K.C.  Supply 

Conditions ;  •  Electrical  power  ON. 

•  Connect  oscilloscope  to  "TPl"  and  adjust  "Pot  1" 
to  effect  a  uniform  sine  wave  output.  Output 
should  be  approximately  7  volts  RMS.  There  is 
no  amplitude  adjustment  requirement.  Adjust  all 
four  channels. 

+14  Vdc  Supply 

Conditions ;  •  Electrical  power  ON. 

•  Connect  voltmeter  to  "tP2"  and  adjust  "Pot  2" 
to  +14  Vdc.  This  adjustment  is  made  on  four 
channels . 
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Control  Path  la 


Conditions :  •  Hydraulic  power  ON. 

Electrical  power  ON. 

All  solenoid  valves  disconnected. 
EHSV  coil  shorted  across. 

TP4  shorted  to  +14  Vdc. 

TP6  shorted  to  +14  Vdc. 

•  Control  path  la  engaged. 

EHSV  Feedback  Loop 


The  purpose  of  this  loop  is  to  improve  the  linearity  of 
the  EHSVs  and  to  maintain  the  null  adjustment. 

•  Adjust  "Pot  3"  to  null  "tP3"  (reference  +14  Vdc). 
This  adjustment  aligns  the  output  of  the  feedback 
with  the  assumed  mechanical  null  of  the  EHSV. 

EHSV  Tracking  Loop 

The  purpose  of  the  loop  is  to  maintain  EHSV  track  with 
the  other  EHSVs. 

•  This  operation  assumes  the  mechanical  null  of  the 
EHSV  is  correct  and  aligns  the  tracking  loop  accord¬ 
ingly.  The  mechanical  null  is  accurate  to  ±2  per¬ 
cent,  which  is  considered  an  adequate  reference 
since  the  second  stage  of  the  EHSV  has  an  overlap  of 
±10  percent. 

Frequency  Response  Test 

Conditions :  •  Hydraulic  power  ON 

•  Electrical  power  ON 

•  All  solenoid  valves  disconnected 
Short  across  EHSV  la  removed 
Control  path  la  engaged 
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Connect  frequency  source  to  pm  IS 

Short  on  TP4  and  TP6  removed 

Conduct  frequency  response  of  the  control  path  and 
EHSV  using  the  LTOT  as  the  output  element. 

Control  Paths  Id,  2a,  and  2b 

Same  as  control  path  la.  Only  the  control  path  in  test 
should  be  engaged. 

3. 1.2. 2  Alignment  of  Electromechanical  Transducers 
Actuator  Feedback  Transducers 


Conditions ; 


Hydraulic  power  ON 
Electrical,  power  ON 
Solenoid  valve  la  (only)  connected 
Control  path  la  engaged 


Use  fly-by-wire  simulation  controller  and  position 
4-valve  actuator  in  increments  and  determine  sensi¬ 
tivity  in  terms  of  volts-per-inch  of  actuator  travel. 


Use  controller  and  drive  4-valve  actuator  in  incre¬ 
ments,  and  measure  track  error  from  stop  to  stop. 


Trim  feedback  transducers  using  transducer  la  as 
reference . 


Fly-by-Wire  Control  Transducers 


Conditions : 


Hydraulic  power  ON 
Electrical  power  ON 
Solenoid  valve  la  (only)  connected 
Control  path  la  engaged 


Use  fly-by-wire  simulation  controller  and  position 
4-valve  actuator  in  increments  and  determine  sensi¬ 
tivity  in  terms  of  volts-per-inch  of  actuator  travel. 


Move  controller  from  stop  to  stop  and  measure  track 
error  of  the  4  controller  transducers. 
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Trim  controller  transducers  using  transducer  la  as 
reference . 


3. 1.2. 3  Autotrackinq  Loop  Test 
Control  Path  la 


Conditions :  •  Hydraulic  power  CN 

Electrical  power  ON 
4  solenoid  valves  disconnected 
All  control  paths  disengaged 

Short  TP4  to  14  Vdc  in  all  control  paths  to  isolate 
the  control  input. 

Engage  control  path  la,  then  the  other  paths  one  at 
a  time. 

Use  pulse  key  on  failure  simulation  panel  and  apply 
pulse  to  control  path  la.  Qualitatively  observe  the 
output  of  LVDT  la  on  an  oscilloscope  and  note  stabil¬ 
ity  characteristics. 

Remove  short  from  TP4  in  all  control  paths. 

Connect  path  la  solenoid. 

Engage  control  path  la;  4-valve  AFCS  actuator  will 
now  track  simulated  fly-by-wire  input. 

Drive  fly-by-wire  actuator  from  stop-to-stop  and 
examine  for  interferences  over  the  complete  range  of 
the  pilot's  mechanical  input.  The  friction  unit  on 
the  pilot's  controls  will  probably  have  to  carry 
some  friction  because  of  the  short  link  arrangements. 

Repeat  with  some  load  applied  by  the  load  actuator. 
Apply  step  input  to  fly-by-wire  actuator  and  observe 
stability  characteristics  on  oscilloscope. 

Drive  fly-by-wire  actuator  in  increments  over  full 
travel  and  check  tracking  of  each  control  path  by 
recording  voltage  on  TP6 .  This  is  the  signal  that 
is  used  through  the  limiting  diodes  at  TP6  for 
autotracking  as  well  as  for  a  signal  to  the  failure 
management  circuitry. 

Tracking  is  expected  to  be  within  0.05  percent  when 
measured  in  terms  of  total  actuator  displacement 
capability . 
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Connect  solenoids  for  control  paths  lb,  2a,  and  2b. 
Engage  control  path  lb. 

Apply  step  input  to  fly-by-wire  actuator  and  quali¬ 
tatively  obseirve  stability  characteristics. 

Engage  control  paths  2a  and  2b. 

Apply  step  input  to  fly-by-wire  actuator  and  qualita¬ 
tively  observe  stability  characteristics. 

Drive  fly-by-wire  over  full  travel  in  increments . 

•  Record  tracking  errors  in  each  path  at  TP6 . 

3.2  OPERATIONAL  SUITABILITY  TEST 

This  test  is  similar  to  the  functional  test  with  the  exception 
that  the  operating  conditions  will  be  varied  and  some  param¬ 
eters  will  be  measured  and  recorded.  The  purpose  of  this  test 
is  to  provide  information  pertinent  to  the  judging  of  the 
operational  suitability  of  the  4-valve  actuation  concept  for 
use  in  a  test  helicopter. 

3.2.1  Characteristics  Under  Normal  Conditions 


Conditions : 


Electrical  power  ON 
Hydraulic  power  ON 
4  control  paths  engaged 
Load  actuator  adjusted  for  typical 
static  load 


Measure  displacement  threshold  of  pilot  controls  in 
terms  of  inches  at  top  of  stick.  This  will  actually 
show  up  as  a  "dead  spot"  in  the  controls.  For  this 
to  be  meaningful,  the  measurement  should  be  corrected 
to  reflect  the  difference  in  the  short  linkage 
control  ratio  and  control  ratio  in  the  test  helicop¬ 
ter. 


Measure  the  fly-by-wire  input  threshold  in  volts 
required  from  the  simulated  inputs  to  effect  a 
displacement  of  the  4-valve  actuator.  As  in  the 
above  case,  this  measurement  should  be  corrected  to 
read  in  terms  of  percent  of  the  actual  capable 
travel  of  the  4-valve  actuator. 
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3.2.2  Characteristics  Under  Single-Failure  Conditions 


Conditions :  Same  as  3.2.1  except  control 

path  la  is  disengaged. 

Procedure ;  Same  as  3.2.1. 

3.2.3  Characteristics  Under  Dual  Failure  Conditions 

3. 2. 3.1  Two  Companion  Control  Paths  (share  same  piston) 

Conditions :  Same  as  3.2.1  except  control 

paths  la  and  lb  are  disengaged. 

Procedures :  Same  as  3.2.1. 

3. 2. 3. 2  Two  Control  Paths  not  Sharing  Same  Piston 

Conditions :  Same  as  3.2.1  except  control 

paths  la  and  2a  are  disengaged. 

Procedures :  Same  as  3.2.1. 

3. 2. 3. 3  One  Control  Path  And  Associated  Failure  Management 
Circuit 

Conditions ;  Same  as  3.2.1  except  control  path 

la  is  failed  "hard"  and  failure 
management  circuit  la  is  inopera¬ 
tive  . 

Procedure ;  Same  as  3.2.1. 

3.2.4  Characteristics  Under  Failure  of  One  Electrical  Supply 

Conditions :  Same  as  3.2.1  except  electrical 

supply  to  control  paths  la  and  lb 
are  off. 

Procedures ;  Same  as  3.2.1. 

3.2.5  Characteristics  under  Complete  Failure  of  Electrical 
and  Hydraulic  Power 

Conditions ;  Same  as  3.2.1  except  all  elec¬ 

trical  and  hydraulic  power  supply 
turned  off. 

Procedure:  Same  as  3.2.1  except  no  test 

required  on  fly-by-wire  actuation 
unit. 
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3.2.6  Fly-by-wire  to  Mechanical  Control  Switching  Transients 


The  purpose  of  this  test  is  to  check  the  transients  induced 
into  the  control  system  when  the  safety  pilot  switches  from 
fly-by-wire  control  to  mechanical  control. 

3. 2. 6.1  Transient  Characteristics  with  4  Control  Path  Engaged 

Conditions ;  •  Electrical  power  On 

Hydraulic  power  ON 
4  control  paths  engaged 

•  Load  actuator  adjusted  for  typi¬ 
cal  static  load 

Connect  volt  meter  to  actuator 
position  signal  for  path  la, 
using  +14V  DC  as  reference 

•  Increase  friction  on  safety 
pilot  stick  to  eliminate  kick- 
back  in  stick. 

•  Note  voltmeter  reading  prior  to  hybrid  actuator  disen¬ 
gagement  and  compare  with  reading  after  disengagement. 

The  difference  in  these  two  measurements  can  be  attributed 
to  the  amount  of  motion  in  the  safety  pilot's  hydraulic 
valve  displacement  translated  into  an  analog  signal  read 
on  the  volt  meter. 

3. 2. 6. 2  Transient  Characteristics  with  one  Path  Disengaged 

Conditions :  Same  as  3. 2. 6.1  except  path  la  dis¬ 

engaged 

Measurements  same  as  in  3. 2. 6.1 

3. 2. 6. 3  Transient  Characteristics  with  two  Paths  Sharing 
Same  Piston  Disengaged. 

Conditions :  Same  as  3. 2. 6.1  except  paths  la  and 

lb  disengaged 

•  Measurements  same  as  in  3. 2. 6.1 
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3. 2. 6. 4  Transient  Characteristics  with  two  Paths  Not  Sharin' 


Same  Piston  Disengaged. 

Conditions :  Same  as  3. 2. 6.1  except  paths  la  and 

2a  disengaged 

Measurements  same  as  in  3. 2. 6.1 


4. 


FAILURE  MODES  AND  EFFECT  TEST 


The  tests  in  this  section  cover  the  basic  type  of  failures 
that  can  occur.  The  intent  is  to  validate  the  4-valve  actu¬ 
ation  concept  as  a  viable  fault- tolerant  actuation  system. 

The  fly-by-wire  control  paths,  up  to  and  including  the  EHSVs, 
will  be  tested  to  assure  a  failure  tolerance  level  (FTL)  of 
dual  fail-operate  for  the  worst  conditions.  The  electrical 
and  hydraulic  power  systems  will  be  tested  to  assure  that  the 
failure  effects  on  the  total  system  will  result  in  an  FTL  of 
single  fail-operate  and  dual  fail-safe. 

The  failure  modes  covered  in  the  subsequent  subsections  will 
be  simulated  using  the  switches  on  the  failure  simulation 
panel;  four  electrical  power  switches,  two  hydraulic  hand 
valves,  and  combinations  of  these  input  devices.  Pertinent 
parameters  will  be  measured  and  recorded  to  define  failure 
effects.  The  measurements  will  be  made  using  an  oscilloscope. 
Except  as  noted,  all  initial  conditions  will  be  for  all  control 
paths  and  power  supplies  will  be  operating. 

4.1  CONTROL  PATHS  AND  FAILURE  MANAGEMENT  SYSTEM 


4.1.1  Transient  Disturbances 

The  purpose  of  this  test  is  to  show  tolerance  to  EMI- type 
disturbances . 

4. 1.1.1  Short  Pulse  -  Control  Path  la  Only 

•  Position  SW2  to  PULSE  position  and  use  momentary  SWl  ap¬ 
plication  to  apply  pulse  (about  0.2-second  pulse). 

Applied  pulse  should  result  in  a  short  duration  jump  at 
the  actuator.  Control  path  la  should  tolerate  this 
disturbance  and  not  disengage. 

•  Adjust  pulse  width  to  aibout  0.4  second  and  apply  pulse. 
Control  path  la  should  disengage. 

•  Reengage  control  path  la. 

4.1.2  First  Hard  Failure 

This  test  is  to  demonstrate  the  ability  of  the  system  to 
manage  hard  failures. 

•  Position  SW2,  control  path  la,  to  HARD  to  simulate  a  hard 
failure. 
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Control  path  la  should  disengage. 


Use  oscilloscope  and  measure  and  record  actuator  dis¬ 
placement  and  time  required  for  recovery. 

4.1.3  Second  Hard  Failure 

This  test  is  to  demonstrate  the  ability  of  the  system  to 
manage  dual  hard  failures . 

Position  SW2,  control  path  2a,  to  HARD  to  simulate  a 
second  hard  failure. 

Control  path  2a  should  disengage. 

Measure  and  record  actuator  displacement  and  time  required 
for  recovery. 

•  Reengage  control  paths  la  and  2a. 

4.1.4  Single  Inert  Control  Path  Failure 

This  test  is  to  demonstrate  the  ability  of  the  system  to 
manage  inert-type  failures  without  requiring  large  actuator 
displacements  to  create  an  error  signal, 

•  Position  SW5,  control  path  la,  to  OPEN  to  simulate  an 
open  EHSV  coil. 

•  Simulate  a  fly-by-wire  control  input;  control  path  la 
should  disengage  immediately. 

Measure  the  magnitude  of  the  control  input  required  to 
effect  a  disengagement. 

Reengage  control  path  la. 

4.1.5  Dual  Inert  Control  Path  Failure 

This  test  is  to  demonstrate  the  ability  to  manage  two  inert 
failures.  If  these  are  not  properly  managed,  a  "two-and-two" 
vote  condition  can  occur.  This  system  recognizes  the  condi¬ 
tion  and  will  disengage  both  faulty  control  paths . 

•  Position  SW5,  control  paths  la  and  lb,  to  OPEN  to  simu¬ 
late  two  open  EHSV  coils. 

•  Simulate  a  fly-by-wire  control  input;  control  paths  la 
and  lb  should  both  disengage. 
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•  Measure  the  magnitude  of  the  fly-by-wire  signal  required 
to  effect  the  disengagement. 

Reengage  control  paths  la  and  lb. 

4.1.6  Failure  Management  Circuitry  Failure  Plus  Associated 
Control  Path  Failure 


This  test  is  to  demonstrate  the  capability  of  the  system  to 
operate  with  one  control  failed  and  not  isolated  by  the  normal 
disengagement . 

Close  SW6,  control  path  la,  to  simulate  an  inert  Failure 
Management  System. 

•  Position  SW2,  control  path  la,  to  HARD  to  simulate  a  hard 
failure . 

The  hard  failure  will  not  effect  a  disengagement  since 
the  associated  failure  management  circuitry  is  inopera¬ 
tive;  the  fault- tolerant  actuation  system  will  still  be 
operable  but  with  a  slight-  static  offset. 

•  Measure  and  record  this  offset. 

•  Measure  and  record  the  stall  load  for  this  condition  in 
terms  of  pressure  on  load  actuator. 

Open  SW6;  control  path  la  should  disengage. 

•  Disengage  control  path  lb. 

•  Measure  stall  load;  this  should  be  about  the  same  as  for 
the  dual  failure  conditions. 

4.1.7  Failure  Management  Circuitry  Shorted  to  Ground 

This  test  is  to  demonstrate  the  capability  of  the  failure 
management  system  to  handle  the  worst  case  type  failures. 

•  Close  SW4,  control  path  la,  to  simulate  a  worst  case 
failure  to  channel  la  failure  management. 

The  hard  failure  will  effect  a  disengagement  in  channel  la 
only.  The  other  channels  will  not  disengage  as  they  receive 
only  approximately  40  percent  of  necessary  voltage  to  dis¬ 
engage  . 


•  Measure  and  record  offset  in  other  channels 

•  Open  SW4 

Engage  channel  la 
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4.2  REVERSION  TO  MECHANICAL  CONTROL 

The  objective  of  this  test  is  to  demonstrate  the  capability  of 
the  actuation  system  to  automatically  switch  to  mechanical 
backup  control  if  all  fly-by-wire  control  paths  should  exper¬ 
ience  failure  and  disengage. 

•  Insert  failure  in  control  path  la,  2a,  and  2b. 

System  should  automatically  revert  to  mechanical  backup. 
Measure  and  record  transit. 

4.3  ELECTRICAL  POWER  SUPPLY 

Three  or  more  electrical  supplies  would  normally  be  used  for 
flight  test  hardware.  For  the  laboratory  test,  however,  only 
two  sources  are  simulated.  The  objective  of  this  test  is  to 
demonstrate  that  after  a  failure  of  electrical  power  to  two 
related  control  paths  (e.g.  la,  lb),  the  actuation  system  con¬ 
tinues  to  operate.  And  after  the  loss  of  electrical  power  to 
the  other  two  controls  paths  (total  loss  of  electrical  power), 
the  hybrid  actuation  system  automatically  reverts  to  manual 
backup  control. 

4.3.1  Single  Failure 

Power  Supply  No.  1  provides  power  to  control  paths  la  and  lb 
while  Supply  No.  2  provides  electrical  power  to  control  paths 
2a  and  2b.  The  existing  power  switches  on  the  Engage/Disengage 
Panel  will  be  used  to  simulate  Electrical  Power  Supplies  Nos. 

1  and  2. 

•  Position  power  switches  for  control  paths  la  and  lb  to 
OFF. 

Control  paths  la  and  lb  will  disengage.  Control  paths  2a 
and  2b  will  continue  to  operate  in  a  normal  manner.  The 
loss  of  the  two  control  paths  will  not  change  the  "flow 
gain"  of  the  actuator;  however,  the  "force  gain"  will  be 
one-half  of  the  normal  gain. 

4.3.2  Dual  Failure 

The  purpose  of  this  test  is  to  demonstrate  that  if  both  elec¬ 
trical  supplies  fail,  the  hybrid  actuator  will  automatically 
provide  the  pilot  with  the  backup  mechanical  input. 

•  Position  power  switches  for  all  control  paths  to  OFF. 


All  control  paths  will  disengage  and  the  mechanical 
backup  control  will  automatically  activate. 


4.4  HYDRAULIC  POWER  SUPPLY 

Three  or  more  hydraulic  supplies  would  normally  be  used  for 
flight  test  hardware.  For  the  laboratory  test,  however,  only 
two  sources  are  simulated.  The  objective  is  to  demonstrate 
that  after  the  hydraulic  power  to  one  piston  is  lost,  the 
actuation  system  will  continue  to  operate,  and  that  after  the 
loss  of  hydraulic  power  to  the  other  piston  (total  loss  of 
hydraulic  power),  the  actuation  system  reverts  to  pure  mechani¬ 
cal  nonboosted  controls. 

4.4.1  Single  Failure 

De-energize  solenoid  valves  1  and  2  to  simulate  loss  of  system 
1.  The  pressure-operated  bypass  valve  will  go  to  bypass 
position  and  system  2  will  continue  to  operate. 

4.4.2  Dual  Failure 

Energize  solenoid  valves  5  and  6;  de-energize  solenoid  valves 
1,  2,  3  and  4.  The  pressure-operated  bypass  valves  in  system 
1  and  2  will  go  to  operate  position  and  shutoff  valves  1,  2,  3 
and  4  will  close  and  the  actuator  will  continue  to  operate  in 
the  pure  manual  mode. 

4.5  SUMMARY  DISCUSSION  ON  FAILURE  MODE  TESTING 

Summary  discussion  will  include  all  test  results  and  any 
peculiarities  that  may  occur  during  testing. 
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